CVE-2026-65702
Gravedad CVSS v4.0:
ALTA
Tipo:
CWE-22
Limitación incorrecta de nombre de ruta a un directorio restringido (Path Traversal)
Fecha de publicación:
23/07/2026
Última modificación:
23/07/2026
Descripción
*** Pendiente de traducción *** Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended store base directory. Attackers can supply path traversal sequences in the conversation_id parameter submitted to the unauthenticated chat API endpoints to escape the base directory during both write and read operations, enabling arbitrary file write with attacker-controlled content and unauthorized file read on the server filesystem.
Impacto
Puntuación base 4.0
8.80
Gravedad 4.0
ALTA
Puntuación base 3.x
8.60
Gravedad 3.x
ALTA