CVE-2026-71492: Banks: Path traversal in `DirectoryPromptRegistry.set()` allows arbitrary file write outside the registry root

September 2, 2026

DirectoryPromptRegistry.set() interpolates the attacker-controllable Prompt.name into a Path expression with no canonicalization. An application that derives the prompt name from request data lets a caller write attacker-controlled bytes outside the configured registry directory.

References

github.com/advisories/GHSA-x8wg-4xgc-vr54
github.com/masci/banks/commit/a215f6d779966945c56e0af5abed1ae5916fd9d3
github.com/masci/banks/pull/77
github.com/masci/banks/releases/tag/v2.4.5
github.com/masci/banks/security/advisories/GHSA-x8wg-4xgc-vr54
nvd.nist.gov/vuln/detail/CVE-2026-71492

Code Behaviors & Features

Detect and mitigate CVE-2026-71492 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →