The masci banks product versions before 2.4.4 contain a path traversal vulnerability (CWE-22) in its media filters (image, audio, video, document). These filters accept user-controlled input as file paths and open them directly without any path sanitization or canonicalization. An attacker controlling template variables can exploit this to read arbitrary files on the server, with contents returned base64-encoded in the prompt output. This vulnerability allows unauthorized disclosure of sensitive files and credentials. The vulnerability is addressed in version 2.4.4.

Successful exploitation allows an unauthenticated attacker to read arbitrary files accessible to the Python process running banks. This can lead to disclosure of sensitive information such as environment variables, SSH private keys, cloud credentials, source code, and critical system files like /etc/passwd and /etc/shadow. The vulnerability does not impact integrity or availability but has high confidentiality impact.

Upgrade to masci banks version 2.4.4 or later, where this path traversal vulnerability has been fixed. There is no indication of an official patch advisory, but the fix is included in version 2.4.4. Until upgrading, avoid processing untrusted user input in template variables passed to banks prompts.