CVE-2026-107716: banks < 2.5.1

Affected technology

banks · < 2.5.1
masci

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Local · Low privileges required · No user interaction required

What an attacker can do

In an application where untrusted users can influence a prompt directory, DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() can follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target. Vendor/CNA’s CVSS 4.0 assessment (base score 7.3/10) rates confidentiality and integrity impact as high; availability impact as low.