CVE-2026-62663

Path traversal in Banks media filters allows for arbitrary file reading.

• CVSS 7.5
• 22
• Input Validation and Sanitization
• Remote

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters (image, audio, video, document) in banks accept untrusted user input as file paths via Path(value) and pass them directly to open(file_path, "rb") without any path sanitization, canonicalization, or directory restriction. An attacker who controls template variables passed to a banks Prompt can use path traversal (../) to read arbitrary files accessible to the Python process—including .env files, SSH keys, cloud credentials, source code, /etc/passwd, and /etc/shadow—with the content returned base64-encoded in the rendered prompt output, making exfiltration trivial. This is particularly dangerous for applications that use banks to process user-provided template variables before sending prompts to an LLM. This issue has been fixed in version 2.4.4.

CVE

CVE-2026-62663

CWE

22

CVSS base score

7.5

Published

2026-07-30

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Missing Check

Category

Input Validation and Sanitization

Subcategory

Path Traversal

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

Banks

Fixed by upgrading

Yes

Solution

Upgrade banks to version 2.4.4 or later.

import base64
from pathlib import Path

# A base directory for media assets, which is not enforced in this version.
MEDIA_ROOT = Path("/var/data/media")

class Prompt:
    def _filter_image(self, value: str) -> str:
        """
        Takes a file path, reads the image, and returns a base64 encoded string.
        """
        # VULNERABLE: User-controlled path is not sanitized or restricted to MEDIA_ROOT.
        file_path = Path(value)

        try:
            with open(file_path, "rb") as f:
                encoded_string = base64.b64encode(f.read()).decode("ascii")
                return f"data:image/jpeg;base64,{encoded_string}"
        except (IOError, FileNotFoundError):
            return ""

import base64
from pathlib import Path

# A base directory for media assets, which is enforced in the fix.
MEDIA_ROOT = Path("/var/data/media").resolve()

class Prompt:
    def _filter_image(self, value: str) -> str:
        """
        Takes a file path, reads the image, and returns a base64 encoded string.
        """
        # FIX: The path is canonicalized and checked to be within MEDIA_ROOT.
        file_path = (MEDIA_ROOT / value).resolve()

        if MEDIA_ROOT not in file_path.parents and file_path != MEDIA_ROOT:
            return ""

        try:
            with open(file_path, "rb") as f:
                encoded_string = base64.b64encode(f.read()).decode("ascii")
                return f"data:image/jpeg;base64,{encoded_string}"
        except (IOError, FileNotFoundError):
            return ""

../../../../../../etc/passwd

@misc{vaitp:cve202662663,
  title        = {{Path traversal in Banks media filters allows for arbitrary file reading.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-62663},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-62663/}}
}