CVE-2026-107716: Path Traversal and Link Following in banks DirectoryPromptRegistry

Vulnerability ID: CVE-2026-107716
CVSS Score: 7.3
Published: 2026-10-08

Improper pathname limitation and link resolution (CWE-22 and CWE-59) in the banks library prior to version 2.5.1 allow local attackers to read or write arbitrary files via crafted symbolic links in the prompt directory registry.

TL;DR

Vulnerability in banks < 2.5.1 allows arbitrary file read and write operations via symbolic links placed inside the prompt registry directory.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22, CWE-59
  • Attack Vector: Local
  • CVSS v4.0: 7.3
  • EPSS Score: N/A
  • Impact: Arbitrary File Read / Arbitrary File Write
  • Exploit Status: None/PoC
  • KEV Status: Not Listed

Affected Systems

  • Applications using the masci/banks library with DirectoryPromptRegistry configured to read or write user-influenced templates
  • banks: < 2.5.1 (Fixed in: 2.5.1)

Code Analysis

Commit: 23ed13e

Prevent symlinks in the prompt registry

Mitigation Strategies

  • Upgrade banks to version 2.5.1 or later
  • Restrict write access to the prompt registry directory
  • Sanitize and reject symbolic links in user-uploaded archives before extraction

Remediation Steps:

  1. Verify the current version of the banks package in use.
  2. Run 'pip install --upgrade banks>=2.5.1' to update the library.
  3. Audit the application configuration to ensure prompt registries point to secure, write-restricted directories.
  4. If using archive extraction for templates, implement verification to drop files of type symlink during extraction.

References

Read the full report for CVE-2026-107716 on our website for more details including interactive diagrams and full exploit analysis.