high8.8
CVE-2026-28676
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI.
Impact
OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI. Prior to version 1.6.3-alpha, multiple storage helpers used path construction patterns that did not uniformly enforce base-directory containment. This created path-injection risk in file read/write/delete flows if malicious path-like values were introduced. This issue has been patched in version 1.6.3-alpha.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Opensift | Opensift | before 1.6.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/OpenSift/OpenSift/commit/1126e0a503876056a68a434e19f64158a5a4840b
- https://github.com/OpenSift/OpenSift/commit/de99b9c
- https://github.com/OpenSift/OpenSift/pull/67
- https://github.com/OpenSift/OpenSift/releases/tag/v1.6.3-alpha
- https://github.com/OpenSift/OpenSift/security/advisories/GHSA-ww4m-c7hv-2rqv