CVE-2026-107716: 
Python vulnerability analysis and mitigation

CVE-2026-107716 is a symlink traversal vulnerability in the DirectoryPromptRegistry component of the Banks Python library, which generates LLM prompts using a Jinja-based template language. The flaw allows an attacker with influence over a prompt registry directory to place symbolic links that cause the library to disclose or overwrite arbitrary files outside the registry root. All versions up to and including 2.5.0 are affected; the issue was fixed in version 2.5.1. It carries a CVSS v3.1 base score of 7.3 (High) and a CVSS v4.0 base score of 7.3 (High) (Github Advisory, Feedly).

The root cause is improper link resolution before file access (CWE-59) combined with path traversal (CWE-22). Specifically, DirectoryPromptRegistry._scan() iterates over .jinja files in the registry directory without checking path.is_symlink(), allowing a symlink pointing to a sensitive file outside the root to be read and indexed. Similarly, _save() and _load() operate on index.json without verifying it is not a symlink, and set() calls prompt_file.write_text() without checking whether the target path is an existing symlink. Exploitation requires that an attacker can place files in the prompt directory — for example, via unpacked archives, shared repositories, or multi-tenant folder access. A public proof-of-concept is included in the GitHub Security Advisory, demonstrating both file disclosure and file overwrite via crafted symlinks (Github Advisory, GitHub PR).

Successful exploitation enables arbitrary file disclosure — an attacker can read any file accessible to the process running Banks (e.g., API keys, configuration files, secrets) by placing a symlink named <name>.<version>.jinja pointing to the target. Additionally, an attacker can overwrite arbitrary files by replacing index.json with a symlink to a target configuration file and then calling reg.set(), which writes attacker-controlled content to the symlink target. The availability impact is rated low, while confidentiality and integrity impacts are both rated high (Github Advisory).

A public proof-of-concept is included in the GitHub Security Advisory, demonstrating both the file disclosure and file overwrite attack paths with minimal code. The vulnerability is local (requires filesystem access to the registry directory) and is not automatable, reducing its overall risk. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and it is not listed in the CISA KEV catalog. The EPSS score is approximately 0.134% (3rd percentile), indicating a low probability of near-term exploitation (Github Advisory, Feedly).

1. Gain write access to the registry directory: The attacker must be able to place files in the DirectoryPromptRegistry directory — for example, by contributing to a shared prompt repository, uploading a crafted archive that is extracted into the registry folder, or exploiting a multi-tenant deployment where users share a prompt directory.
2. File disclosure via .jinja symlink: Create a symbolic link named <name>.<version>.jinja (e.g., leak.0.jinja) pointing to a sensitive file outside the registry root (e.g., /etc/passwd or a file containing API tokens): os.symlink('/tmp/secret.txt', reg_dir / 'leak.0.jinja').
3. Trigger _scan() or get(): Instantiate or use DirectoryPromptRegistry with force_reindex=True, or call reg.get(name='leak', version='0'). The library follows the symlink and reads the external file's contents, which are returned as the prompt's raw text.
4. File overwrite via index.json symlink: Remove the existing index.json and replace it with a symlink pointing to a target file to overwrite (e.g., an application config): os.symlink('/tmp/target.conf', reg_dir / 'index.json').
5. Trigger _save() via set(): Call reg.set(prompt=Prompt('malicious content', name='test', version='1')). The library writes attacker-controlled JSON content to the symlink target, overwriting the external file (Github Advisory).

• File System: Presence of .jinja files in the Banks registry directory that are symbolic links (detectable via find <registry_dir> -name '*.jinja' -type l); index.json in the registry directory being a symbolic link (ls -la <registry_dir>/index.json).
• File System: Unexpected modification timestamps on sensitive files (e.g., configuration files, credential stores) that coincide with Banks registry operations.
• Logs: Application logs showing InvalidPromptError exceptions referencing "symbolic link" after upgrading to 2.5.1, which may indicate attempted exploitation against a patched instance.
• Process: The Python process running Banks reading files outside the expected registry directory path, observable via strace/auditd file access monitoring (openat syscalls resolving to paths outside the registry root) (Github Advisory).

Upgrade the banks pip package to version 2.5.1 or later, which adds symlink rejection in _scan(), _validate_index_path(), _resolve_prompt_file(), and uses O_NOFOLLOW for file writes where supported by the OS. No configuration-based workaround is available for unpatched versions; the only mitigation is to ensure untrusted users cannot write files to the prompt registry directory. Organizations using NixPkgs should track the upstream fix referenced in NixOS/nixpkgs#572128 (GitHub Release, GitHub PR).