CVE-2026-107716: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in masci banks

The vulnerability involves improper limitation of a pathname to a restricted directory (CWE-22) in the DirectoryPromptRegistry of masci banks. Before version 2.5.1, the registry does not reject symbolic links for index.json or .jinja prompt files. If an attacker can influence the prompt directory or its extracted contents, methods such as _scan() and get() can follow symbolic links outside the registry root to disclose files, while set(), _save(), and _load() can read or overwrite files outside the intended directory. This allows unauthorized file disclosure and modification. The vulnerability requires attacker control over the registry directory or its contents and is resolved in version 2.5.1.

An attacker with limited privileges and influence over the prompt directory can exploit this vulnerability to read or overwrite files outside the intended directory via symbolic links. This can lead to unauthorized disclosure of sensitive files and potential modification of files, impacting confidentiality and integrity. The CVSS 4.0 score is 7.3 (high severity), reflecting the potential for significant impact with low attack complexity and no user interaction required.

Upgrade to masci banks version 2.5.1 or later, where this vulnerability is fixed. No additional mitigation is required once the official fix is applied.