CVE-2026-107716: Path Traversal and Link Following in banks DirectoryPromptRegistry

The library banks provides prompt management and templating capability, serving as a layer on top of the Jinja rendering engine. Within this library, the class banks.registries.DirectoryPromptRegistry manages on-disk storage, parsing, and indexing of prompt template files. Applications utilizing this registry component face exposure if they process template directories modified by untrusted entities.

This vulnerability, classified under CVE-2026-107716, belongs to the Improper Limitation of a Pathname (CWE-22) and Link Following (CWE-59) bug classes. Prior to the patch in version 2.5.1, the component failed to validate filesystem node characteristics before resolving paths and executing read or write operations. Consequently, symbolic links placed inside the registry root are traversed, leading to unauthorized access outside the intended directory boundary.

The attack surface becomes active in architectures where users can upload template packages or control the files loaded by the application. Because the engine resolves these inputs automatically, an attacker can read sensitive system credentials or corrupt existing configuration files. This document details the exact mechanics of the vulnerability, the structural root causes, and the corresponding mitigation path.

The primary root cause of this vulnerability lies in the lack of filesystem verification during the index-building and prompt-retrieval phases. When DirectoryPromptRegistry processes the directory tree, it iterates over all files matching the target suffix without checking if they are symbolic links. Standard Python library functions like path.open() or path.read_text() resolve symbolic links transparently at the operating system level, which allows the retrieval of files outside the designated registry path.

A secondary structural weakness exists in the write operations conducted during index updates and template modification. The registry uses direct filesystem writing methods that do not specify protection flags against symbolic link traversal. When a template is saved or the index is updated, the engine follows any pre-existing symbolic link mapped to the index or template filename, causing the application to write data to unintended external locations.

To exploit this behavior, an attacker must successfully plant symbolic links inside the folder configured as the prompt registry. This condition is commonly met in multi-tenant environments, content management systems, or platforms that extract compressed archive uploads without validating entry types. Once the links are in place, any subsequent read or write action performed by the application triggers the vulnerability, operating with the full permissions of the parent process.

In vulnerable versions of the library, the registry resolves prompt paths using standard concatenation without checking for directory escape or symlink patterns. The _resolve_prompt_file function merely appended names to the root path, which is illustrated in the following diagram representing the data flow:

The patched version introduces explicit validations to verify path alignment and reject symbolic link structures. First, the library scans and verifies that files inside the registry root do not match symbolic links. In the _resolve_prompt_file function, the code now checks candidate.is_symlink() and raises an InvalidPromptError if a symlink is encountered.

# Patched implementation in directory.py
root = registry_root.resolve()
candidate = registry_root / f"{name}.{version}.jinja"
if candidate.is_symlink():
    msg = f"Prompt path is a symbolic link: {candidate}"
    raise InvalidPromptError(msg)
resolved = candidate.resolve()
if not resolved.is_relative_to(root):
    msg = f"Prompt path escapes registry root: {resolved}"
    raise InvalidPromptError(msg)

Additionally, write operations are secured against concurrent link manipulation using low-level file descriptors. The library utilizes os.O_NOFOLLOW on supported platforms to instruct the kernel to abort the write operation if the target path resolves to a link. This technique effectively closes the window of opportunity for symbolic link modification during file creation.

Exploitation of this vulnerability is achieved in two distinct modes depending on whether the target operation is a read or write action. In both scenarios, the primary prerequisite is the ability of the attacker to introduce symbolic links into the registry path. This prerequisite is met when the application processes uploaded zip files, untrusted git repositories, or shared filesystem directories.

For an arbitrary file read, the attacker creates a symbolic link that points to a target system file, such as /etc/passwd. The symbolic link is named to match the template naming convention, for example leak.0.jinja. When the application initializes the registry or updates the index, it scans the directory, follows the link, reads the contents of /etc/passwd, and stores the content in memory as the template body, making it retrievable by the attacker.

For an arbitrary file write, the attacker leverages the index update mechanism or the template storage routines. The attacker plants a symbolic link named index.json pointing to a target system configuration file or script. When the registry updates its internal index or saves a new prompt, the _save() routine writes the serialized data to index.json. The operating system follows the link, overwriting the target system file with the serialized index data, which can disrupt services or alter behavior.

The impact of CVE-2026-107716 is classified as high, as it permits both unauthorized read and write access to files on the host system. Through arbitrary file disclosure, an attacker can extract sensitive configuration profiles, private keys, database credentials, and environment files. The severity is determined by the privileges of the system user executing the application process.

Through arbitrary file write operations, the risk extends to application state corruption and potential control flow hijacking. By overwriting key configuration files, an attacker can disable security controls or redirect traffic. In environments where the application runs with elevated privileges, overwriting critical files like system crontabs or startup scripts can lead to code execution.

The CVSS v4.0 score is assessed at 7.3, reflecting high confidentiality and integrity impacts under local access conditions. Although direct local access is typically required to place the symlinks, remote exploitation remains possible if the application exposes file upload or archive extraction endpoints. The vulnerability is currently not listed on the CISA Known Exploited Vulnerabilities catalog, indicating no widespread active campaign.

The primary remediation is upgrading the banks package to version 2.5.1 or later, which incorporates the path containment and symbolic link checks. This update modifies the scanning and writing processes to actively reject symbolic links and verify that resolved paths lie strictly within the registry directory. This blocks both read and write traversal techniques.

If upgrading immediately is not feasible, operational mitigations must be implemented to secure the directory contents. The prompt registry directory should be set to read-only for the application process during runtime, preventing the injection or modification of files. Any file upload, archive extraction, or remote repository synchronization feature must be strictly isolated and scanned to reject symlink files before they reach the registry path.

Developers should also audit application architectures to ensure that user-supplied templates are never directly stored in the filesystem registry. Implementing strict validation on template names and version strings prevents directory traversal sequences from bypassing basic check logic. These layers of defense ensure the application remains secure even if underlying library methods face unforeseen bypasses.