CVE-2026-22661 is a path traversal vulnerability (CWE-22) in prompts.chat prior to commit 0f8d4c3, specifically in the handling of skill file ZIP archives. The server does not properly validate filenames within uploaded ZIP files, allowing attackers to include path traversal sequences that cause extraction outside the designated directory. This can result in arbitrary file write on the client system, including overwriting shell initialization files, which may lead to remote code execution. The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity. There is no vendor advisory or patch available at this time, and the product is not a cloud service.

Successful exploitation allows an unauthenticated attacker to write arbitrary files to the client system by exploiting missing server-side filename validation in skill file archives. This can lead to overwriting critical files such as shell initialization scripts, enabling code execution with the privileges of the affected user. The vulnerability poses a high risk due to the potential for remote code execution and system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted skill file ZIP archives with prompts.chat version 0. Implement manual validation or sandbox extraction processes to prevent path traversal during archive extraction.