# CVE-2026-107716: Banks DirectoryPromptRegistry symlink traversal arbitrary file disclosure and overwrite

Source: https://junglewise.ai/threats/cve-2026-107716-banks-symlink-traversal-and-arbitrary-file-disclosure-overwrite  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-08. Updated: 2026-10-08  
License: CC BY 4.0 with a link back

CVE-2026-107716 · Severity: medium · Published 2026-10-08

Banks is a Python library for managing prompts used by AI applications. A flaw in its DirectoryPromptRegistry component fails to validate symbolic links, allowing an attacker to read sensitive files or overwrite critical configuration files if the prompt directory contains untrusted content (such as from extracted archives or shared repositories).

Technologies: [banks (PyPI)](https://junglewise.ai/threats/technologies/pypi-banks). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-107716 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107716 being exploited in the wild.

**How severe is CVE-2026-107716?** Medium severity, published 8 October 2026.

**Which products and versions are affected?** banks (PyPI) <= 2.5.0, ECOSYSTEM:introduced=0,fixed=2.5.1.

**Is there a fix for CVE-2026-107716?** Yes. banks (PyPI): upgrade to 2.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107716 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-107716?** Check whether you run Jankesec Banks or banks (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- banks (PyPI): upgrade to 2.5.1 or later

  ```sh
  pip install "banks>=2.5.1"
  ```


## Technical details

DirectoryPromptRegistry does not check for symbolic links when loading prompt files or the index file, violating CWE-59 (path traversal). The vulnerable code paths are: _scan() reads .jinja files without rejecting symlinks; _load() and _save() operate on the index file without validating it is not a symlink; and set() writes to prompt files without verifying they are not existing symlinks pointing outside the registry root. An attacker who can place symbolic links in the registry directory (e.g., via archive extraction or multi-tenant access) can disclose arbitrary files via get() or overwrite arbitrary files via set().

## Affected products

- jankesec banks

## Identifiers

- CVE-2026-107716
- GHSA-556j-vv39-8rqv
- PYSEC-2026-4201

## Timeline

- 2026-10-08: disclosed

## Related threats

- [Banks Prompt chat role injection via user-controlled input](https://junglewise.ai/threats/cve-2026-107717-banks-user-controlled-prompt-input-can-be-parsed-as-privileged)
- [Banks DirectoryPromptRegistry path traversal in set()](https://junglewise.ai/threats/cve-2026-71492-banks-directorypromptregistry-path-traversal-in-set)
- [masci banks remote code execution via unsafe Tool import_path](https://junglewise.ai/threats/cve-2026-61536-masci-banks-remote-code-execution-via-unsafe-tool-import-path)