CVE-2026-62663 Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document)
Attackers can read arbitrary files via path traversal in media filters, exposing sensitive data like credentials and keys in LLM prompts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-62663?
CVE-2026-62663 is a high-severity path traversal vulnerability in masci banks, published on 30 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters (image, audio, video, document) in banks accept untrusted user input as file paths via Path(value) and pass them directly to open(file_path, "rb") without any path sanitization, canonicalization, or directory restriction. An attacker who controls template variables passed to a banks Prompt can use path traversal (../) to read arbitrary files accessible to the Python process—including .env files, SSH keys, cloud credentials, source code, /etc/passwd, and /etc/shadow—with the content returned base64-encoded in the rendered prompt output, making exfiltration trivial. This is particularly dangerous for applications that use banks to process user-provided template variables before sending prompts to an LLM. This issue has been fixed in version 2.4.4.
Weakness: CWE-22
Which versions are affected by CVE-2026-62663?
How do I fix CVE-2026-62663?
No fix has been published for CVE-2026-62663 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-62663 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62663 exists.
Sources
Also known as GHSA-98rr-gvc9-3cjh.