CVE-2026-107716

Deferred Deferred - Pending Action

Path Traversal in Banks Prompt Registry

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. The issue requires attacker influence over the registry directory or its extracted contents. This issue is fixed in version 2.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-107716

Affected Vendors & Products

Vendor	Product	Version / Range
masci	banks	< 2.5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Banks is a tool that generates prompts for large language models using a template system. Prior to version 2.5.1, it had a flaw where the DirectoryPromptRegistry component did not properly handle symbolic links. This allowed untrusted users who could influence the prompt directory to manipulate the system into accessing or modifying files outside the intended registry directory.

Detection Guidance

This vulnerability involves symbolic link handling in Banks versions prior to 2.5.1. To detect it, inspect prompt directories for symbolic links pointing outside the registry root. Check for unexpected .jinja files or index.json links. Use commands like 'find /path/to/prompt/dir -type l -ls' to list symbolic links and 'ls -la /path/to/prompt/dir' to verify file types and locations.

Impact Analysis

If you use Banks in an environment where untrusted users can influence the prompt directory, an attacker could exploit this to read sensitive files outside the registry or overwrite important files by following symbolic links. This could lead to data leaks or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection requirements or HIPAA's privacy rules. Organizations using Banks in regulated environments must ensure they are running version 2.5.1 or later to avoid compliance risks.

Mitigation Strategies

Upgrade Banks to version 2.5.1 or later immediately. Remove or restrict write access to the prompt directory for untrusted users. Audit existing prompt directories for symbolic links and unauthorized files. Ensure DirectoryPromptRegistry only accesses files within its intended root directory.

Hi! I’m here to help you understand CVE-2026-107716. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70