CVE-2026-62663 in banks
Summary
by MITRE • 07/30/2026
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters (image, audio, video, document) in banks accept untrusted user input as file paths via Path(value) and pass them directly to open(file_path, "rb") without any path sanitization, canonicalization, or directory restriction. An attacker who controls template variables passed to a banks Prompt can use path traversal (../) to read arbitrary files accessible to the Python process—including .env files, SSH keys, cloud credentials, source code, /etc/passwd, and /etc/shadow—with the content returned base64-encoded in the rendered prompt output, making exfiltration trivial. This is particularly dangerous for applications that use banks to process user-provided template variables before sending prompts to an LLM. This issue has been fixed in version 2.4.4.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical path traversal flaw in the banks library that enables arbitrary file read access through improperly sanitized user input. The issue manifests when applications use banks to generate large language model prompts with template variables, where attackers can manipulate file path parameters to access sensitive system resources. The vulnerability exists specifically in versions prior to 2.4.4 and affects all four media filter types including image, audio, video, and document processing capabilities.
The technical implementation of this flaw occurs through the direct passing of user-controlled file paths to Python's open() function without any input validation or sanitization measures. When template variables containing path traversal sequences like "../" are processed through Path(value) and subsequently passed to open(file_path, "rb"), the system performs no canonicalization or directory restriction checks. This allows attackers to navigate beyond intended directories and access arbitrary files that the Python process has permission to read.
The operational impact of this vulnerability is severe and multifaceted, as it enables attackers to exfiltrate sensitive data including environment variables, SSH private keys, cloud service credentials, source code repositories, and system configuration files. The base64-encoded output format makes data extraction straightforward for attackers, while the vulnerability's presence in template processing systems means that user-provided content can be weaponized to access system resources. This creates a particularly dangerous scenario for applications that process untrusted user input through banks before sending prompts to language models.
This vulnerability aligns with CWE-22 Path Traversal and CWE-73 Path Traversal, representing a classic directory traversal attack vector that bypasses proper input validation controls. The issue also maps to ATT&CK technique T1059.001 Command and Scripting Interpreter and T1566.001 Phishing: Spearphishing Attachment, as it enables attackers to extract sensitive information from compromised systems through crafted template variables. Additionally, the vulnerability demonstrates characteristics of privilege escalation through improper input handling, as it allows attackers to access files that should normally be restricted to authorized users only.
The mitigation strategy requires immediate upgrade to version 2.4.4 or later where proper path sanitization and canonicalization have been implemented. Organizations should also implement additional controls such as restricting file access permissions for the Python process, implementing strict input validation for all template variables, and using sandboxed execution environments for processing untrusted content. Regular security audits of template processing systems and monitoring for unusual file access patterns should be implemented to detect potential exploitation attempts.