Threats affecting pkg:github/deepractice/PromptX

CVE-2026-7217 is an absolute path traversal vulnerability in Deepractice PromptX versions up to 2.4.0. It affects the Document File Handler component, specifically functions handling document reading such as read_docx, read_xlsx, read_pptx, list_xlsx_sheets, and read_pdf. This vulnerability allows remote attackers to manipulate file paths to access arbitrary files on the system. The vulnerability has been publicly disclosed, but the vendor has not yet responded or provided a fix. The CVSS 4.0 base score is 6.9, indicating a medium severity level.