The vulnerability CVE-2026-5595 affects griptape-ai griptape 0.19.4 in the FileManagerTool component, specifically in the functions load_files_from_disk, list_files_from_disk, save_content_to_file, and save_memory_artifacts_to_disk. These functions are susceptible to path traversal attacks, which allow an attacker to manipulate file paths to access or modify files outside the intended directories. The attack can be performed remotely with low privileges and does not require user interaction. The vulnerability has been publicly disclosed, but the vendor has not issued any advisory or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to read or write arbitrary files on the affected system, potentially leading to unauthorized data access or modification. The impact is rated as medium severity with a CVSS 4.0 score of 5.3. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a patch, users should consider implementing temporary mitigations such as restricting access to the vulnerable functions, applying input validation or sanitization on file paths, and limiting the privileges of the application to minimize potential damage. Monitor official channels for updates from the vendor.