Symlink traversal in Banks DirectoryPromptRegistry
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Partial Red Hat: 3 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Banks versions before 2.5.1 are affected. DirectoryPromptRegistry does not reject symbolic links for index.json or .jinja prompt files, so a link can point outside the registry root (CWE-59). A local attacker with low privileges who can influence a prompt directory or its extracted contents can read or overwrite files outside the registry.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. The issue requires attacker influence over the registry directory or its extracted contents. This issue is fixed in version 2.5.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| masci | banks | before 2.5.1 | 2.5.1 | Patch available | CNA |
| — | banks (PyPI) | before 2.5.1 | 2.5.1 | Patch available | GHSA-556j-vv39-8rqv |
- banks Vendormasci Affected before 2.5.1 Fixed in 2.5.1 Patch available CNA
- banks (PyPI) Vendor— Affected before 2.5.1 Fixed in 2.5.1 Patch available GHSA-556j-vv39-8rqv
Remediation
Upgrade the PyPI package banks to version 2.5.1, which fixes this issue. Red Hat lists Exploit Intelligence, Lightspeed Core and OpenShift Lightspeed as affected with no plan available.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA banks (masci) Fixed in 2.5.1
- Fix · GHSA-556j-vv39-8rqv banks (PyPI) Fixed in 2.5.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| Lightspeed Core | Affected | No fix yet |
| OpenShift Lightspeed | Affected | No fix yet |
Not affected: 1 product
- Red Hat Ansible Automation Platform 2
Timeline
- 2026-10-09 Threatist record created from CVE-2026-107716
- 2026-10-09 Alias added: GHSA-556j-vv39-8rqv
- 2026-10-10 Affected versions changed · Red Hat
- 2026-10-10 CVSS score added · Red Hat
- 2026-10-10 CISA SSVC decision points changed
- 2026-10-10 Priority changed: MEDIUM → LOW
- 2026-10-21 Affected versions changed · Red Hat
References
More masci vulnerabilities
- TI-2026-44773 Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document) CVSS 3.1HIGH 7.5
- TI-2026-69696 Banks parses untrusted prompt input as privileged chat messages CVSS 3.1MEDIUM 6.5
- TI-2026-44099 Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE CVSS 3.1HIGH 7.5
- TI-2026-32188 Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI CVSS 3.1HIGH 7.5
- TI-2026-50100 Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root CVSS 4.0MEDIUM 6.0
Sources
- CVE-2026-107716 · CVE Program
- CVE-2026-107716 · NVD
- FIRST EPSS
- GHSA-556j-vv39-8rqv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-107716 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences