CVE-2026-65702 describes a path traversal vulnerability in vanna-ai's vanna product, specifically in the FileSystemConversationStore persistence integration. Versions up to and including 2.0.2 are affected. Unauthenticated remote attackers can exploit this by submitting specially crafted conversation_id parameters containing path traversal sequences to the chat API endpoints. This allows them to escape the base directory restriction and perform arbitrary file writes with attacker-controlled JSON content, as well as unauthorized file reads of conversation metadata from outside the intended storage directory. The vulnerability has a CVSS 4.0 score of 8.8, indicating high severity, with network attack vector, no privileges or user interaction required, and significant impact on confidentiality and integrity.

Successful exploitation allows unauthenticated attackers to write arbitrary files anywhere on the server filesystem accessible by the application, potentially leading to code execution or persistent compromise. Additionally, attackers can read sensitive conversation metadata outside the intended storage directory, compromising confidentiality. This can lead to data leakage and system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the vulnerable API endpoints and monitor for suspicious activity. Avoid exposing the chat API to untrusted networks. Apply principle of least privilege to the filesystem permissions of the application to limit the impact of arbitrary file writes.