CVE-2026-71492 masci CVE debrief

Who should care

Defenders who are responsible for the security of the Banks application should care about this vulnerability. They should verify the affected versions of the application and apply the patch to prevent potential path traversal attacks.

Why it matters

CVE-2026-71492 is a path traversal vulnerability in the Banks application that allows an attacker to write Prompt.raw bytes to attacker-chosen paths writable by the application process. Defenders should verify the affected versions of the application and apply the patch to prevent potential security incidents.

• Path traversal attacks may be possible
• Verify affected versions and apply patch

Technical summary

The vulnerability exists in the DirectoryPromptRegistry.set() function, which interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without canonicalization or containment validation. This allows an attacker to write Prompt.raw bytes to attacker-chosen paths writable by the application process. The affected versions of the Banks application are prior to version 2.4.5. Defenders should prioritize verifying the affected versions of the Banks application and applying the patch to prevent potential path traversal attacks.

Defensive priority

Defenders should prioritize verifying the affected versions of the Banks application and applying the patch to prevent potential path traversal attacks.

Recommended defensive actions

• Verify the affected versions of the Banks application
• Apply the patch to prevent potential path traversal attacks
• Monitor the application for potential security incidents
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the lack of canonicalization or containment validation in the DirectoryPromptRegistry.set() function. The affected versions of the Banks application are prior to version 2.4.5. The patch is available in version 2.4.5.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.