Executive brief
Vanna, an open-source AI framework, contains a security flaw in how it stores chat history on a server's disk. An unauthenticated attacker can send specially crafted requests to save files in restricted folders or read private conversation data they shouldn't have access to. This could allow an attacker to disrupt the service, tamper with system configurations, or potentially gain further control over the server if they can write files to sensitive locations like startup folders.
Technical details
A path traversal vulnerability exists in Vanna's FileSystemConversationStore integration due to insufficient sanitization of the 'conversation_id' parameter. The '_get_conversation_dir' method in 'file_system_conversation_store.py' directly concatenates the client-provided ID to a base directory using the '/' operator without validation. An unauthenticated remote attacker can use '../' sequences in API requests (such as /api/vanna/v2/chat_sse) to escape the intended storage directory. This enables arbitrary file writes of attacker-controlled JSON content and unauthorized reading of conversation metadata from the server's filesystem. The project was archived in March 2026, and no official patch is currently available; users are advised to implement path normalization and containment checks manually.
Affected products
- vanna-ai vanna <= 2.0.2
Timeline
- 2026-03-29: other: Project archived by owner
- 2026-07-23: disclosed
- 2026-07-23: advisory