CVE-2026-71492

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Published

Aug 20, 2026, 4:13:55 PM UTC

Updated

Aug 20, 2026, 5:19:40 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.47% · Oct 25, 2026

A flaw was found in Banks. The `DirectoryPromptRegistry.set()` function improperly handles attacker-controlled `Prompt.name` and `Prompt.version` values. This allows for path traversal, enabling an attacker to write arbitrary files outside the intended registry root. This vulnerability could lead to unauthorized modification of files on the system where Banks is running. banks: Banks: Arbitrary file write via path traversal The 'banks' library is vulnerable to arbitrary file write via path traversal when an application processes attacker-controlled input for prompt names or versions. This flaw allows an attacker to write arbitrary files to locations writable by the application process, potentially leading to system compromise. The impact is dependent on the application's exposure of these fields to untrusted data and the privileges under which the application runs. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.