CVE-2026-65702 in vanna
Summary
by MITRE • 07/23/2026
Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended store base directory. Attackers can supply path traversal sequences in the conversation_id parameter submitted to the unauthenticated chat API endpoints to escape the base directory during both write and read operations, enabling arbitrary file write with attacker-controlled content and unauthorized file read on the server filesystem.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability exists within the FileSystemConversationStore persistence mechanism of Vanna version 2.0.2, representing a critical path traversal flaw that undermines the application's security boundaries. The issue stems from inadequate input validation and sanitization of the conversation_id parameter, which is processed through unauthenticated chat API endpoints without proper restrictions on filesystem access paths. The vulnerability allows attackers to manipulate file system operations by injecting path traversal sequences such as ../ or ..\ into the conversation_id parameter, effectively bypassing intended directory restrictions and enabling unauthorized access to arbitrary filesystem locations.
The technical implementation of this flaw demonstrates a classic path traversal vulnerability classified under CWE-22, where insufficient validation of user-supplied input permits attackers to traverse the file system hierarchy beyond the intended boundaries. When the application processes requests containing malicious conversation_id values, it fails to properly canonicalize or validate these inputs before using them in file system operations. This weakness affects both read and write operations within the persistence layer, creating a dual threat scenario where attackers can not only read sensitive files from outside the designated storage directory but also write arbitrary JSON content to any location accessible by the application process.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it enables complete arbitrary file system manipulation capabilities that align with ATT&CK technique T1074.001 for data staging and potentially T1566.001 for initial access through web applications. Attackers can leverage this vulnerability to escalate privileges by writing malicious configuration files or scripts into critical system directories, read sensitive application metadata, or extract conversation data from unauthorized locations. The unauthenticated nature of the affected API endpoints means that any remote attacker with network access to the application can exploit this vulnerability without requiring valid credentials, making it particularly dangerous in production environments.
Mitigation strategies should focus on implementing strict input validation and sanitization measures for all user-supplied parameters that influence file system operations. The recommended approach includes canonicalizing all file paths using proper path resolution functions and implementing whitelist-based validation for conversation_id values to ensure they conform to expected naming conventions and directory structures. Additionally, the application should enforce strict directory boundaries through proper sandboxing techniques, ensuring that all file system operations occur within designated safe directories with appropriate access controls. Organizations should also implement monitoring and logging mechanisms to detect anomalous file system access patterns that may indicate exploitation attempts, while considering principle of least privilege access controls for the application's file system permissions.