High severity · published Oct 8, 2026
CVE-2026-107716
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
7.3
CVSS
0.1%
EPSS
No
On KEV
Description
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. The issue requires attacker influence over the registry directory or its extracted contents. This issue is fixed in version 2.5.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
banks · masci
< 2.5.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107716
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107716
x_refsource_CONFIRM
https://github.com/masci/banks/security/advisories/GHSA-556j-vv39-8rqv
x_refsource_MISC
https://github.com/masci/banks/pull/79
x_refsource_MISC
https://github.com/masci/banks/commit/23ed13e50b4e217693fa5f9c30943fac8a41582f
x_refsource_MISC
https://github.com/masci/banks/releases/tag/v2.5.1
More from banks
7.5
CVE-2026-61536
Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE
7.5
CVE-2026-62663
Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document)
7.5
CVE-2026-44209
Banks: Critical Remote Code Execution (RCE) via Jinja2 SSTI
6.5
CVE-2026-107717
Banks: User-controlled prompt input can be parsed as privileged chat messages
6.0
CVE-2026-71492
Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root