CVE-2026-107716 masci CVE debrief

Who should care

Defenders responsible for systems using Banks DirectoryPromptRegistry should assess exposure and prioritize verification and remediation efforts. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-107716 is a high-severity vulnerability in Banks DirectoryPromptRegistry that allows for symlink traversal and arbitrary file disclosure/overwrite. Defenders should prioritize verifying and upgrading to version 2.5.1 or later, assessing exposure in their environment, and monitoring for potential exploitation attempts.

• Potential for unauthorized file disclosure
• Potential for arbitrary file overwrite
• Need for verification of version and exposure
• Prioritization of remediation efforts

Technical summary

The DirectoryPromptRegistry in Banks does not reject symbolic links for index.json or discovered and existing .jinja prompt files, allowing for symlink traversal and arbitrary file disclosure/overwrite. This issue requires attacker influence over the registry directory or its extracted contents and is fixed in version 2.5.1. The vulnerability allows DirectoryPromptRegistry._scan() and DirectoryPromptRegistry.get() to follow a link outside the registry root and disclose a file, while DirectoryPromptRegistry.set(), DirectoryPromptRegistry._save(), and DirectoryPromptRegistry._load() can read or overwrite an external link target.

Defensive priority

Defenders should prioritize verifying and upgrading to version 2.5.1 or later, assessing exposure in their environment, and monitoring for potential exploitation attempts.

Recommended defensive actions

• Verify and upgrade to version 2.5.1 or later
• Assess exposure in your environment
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. Evidence is limited to public CVE Program and NVD records. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations. The CVE record and NVD detail page provide information on the vulnerability, including its description, CVSS score, and affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.