CVE-2026-107716 in Banks
Summary
by MITRE • 10/09/2026
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. The issue requires attacker influence over the registry directory or its extracted contents. This issue is fixed in version 2.5.1.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified as Banks DirectoryPromptRegistry path traversal allows for unauthorized file access and modification due to insufficient validation of symbolic links within prompt directories. In versions prior to 2.5.1, the system utilizes a template language to generate Large Language Model prompts by scanning specific directories for index files and Jinja template files. The core technical flaw lies in the DirectoryPromptRegistry class methods which fail to reject or validate symbolic links when processing index.json or discovered .jinja prompt files. This lack of validation permits an attacker who has influence over the registry directory or its extracted contents to manipulate file system paths by creating symlinks that point outside the intended registry root directory.
From a technical perspective, this flaw manifests in multiple operational modes of the application. When using DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get(), the application follows symbolic links without restriction, leading to information disclosure as it reads files located in arbitrary directories on the host system rather than restricting access to the designated prompt directory. Similarly, when utilizing DirectoryPromptRegistry.set(), _save(), or _load(), the application allows writing operations through these symlinks, enabling an attacker to overwrite external file targets with malicious content. This effectively transforms a local configuration management feature into a mechanism for arbitrary read and write operations on the underlying operating system files accessible by the user running the application process.
The operational impact of this vulnerability is significant in environments where untrusted users can influence the prompt directory structure, such as multi-tenant applications or systems allowing user-uploaded templates. An attacker could leverage this flaw to exfiltrate sensitive configuration data, credentials, or source code stored outside the web root or application sandbox by reading them through symlinked paths. Conversely, if write permissions are granted via set and save operations, an attacker could overwrite critical system files, potentially leading to remote code execution or denial of service conditions depending on the target file's role within the infrastructure. This behavior aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory, as the application fails to properly restrict access to resources outside the intended directory boundary.
In terms of threat modeling and industry standards, this vulnerability facilitates path traversal attacks that can be categorized under ATT&CK technique T1083 File and Directory Discovery for information gathering or T1564 Hidden Files and Directories if symlinks are used to obscure malicious file placement. The attack vector typically requires local access or the ability to upload files into a controlled directory, making it primarily relevant in scenarios where user input directly controls filesystem paths without adequate sanitization. Mitigation strategies involve upgrading to version 2.5.1 of Banks which addresses this issue by implementing strict validation that rejects symbolic links during both scanning and writing operations. Additionally, developers should ensure that file system interactions are confined within a chroot environment or use secure temporary directories with restricted permissions to minimize the blast radius if similar vulnerabilities arise in other components.