Executive Summary

This vulnerability exists in prompts.chat prior to commit 0f8d4c3 and involves a path traversal issue in the handling of skill files.

Attackers can craft malicious ZIP archives containing filenames with path traversal sequences (such as ../) that are not properly sanitized by the server.

When these ZIP archives are extracted by the vulnerable tool, files can be written outside the intended directory, potentially overwriting important files like shell initialization files.

This allows attackers to execute arbitrary code on the client system.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized code execution on your system.

Because attackers can write arbitrary files outside the intended directories, they may overwrite critical configuration or initialization files, leading to system compromise.

The CVSS v3.1 score of 8.1 (High) and v4.0 score of 8.6 (High) reflect the severity and ease of exploitation, as it requires no privileges and low attack complexity.

Useful 0 Not Useful 0