Vulnerability Description
Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended store base directory. Attackers can supply path traversal sequences in the conversation_id parameter submitted to the unauthenticated chat API endpoints to escape the base directory during both write and read operations, enabling arbitrary file write with attacker-controlled content and unauthorized file read on the server filesystem.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/geo-chen/oss/blob/main/vanna.md
- https://www.vulncheck.com/advisories/vanna-path-traversal-via-filesystemconversa
FAQ
What is CVE-2026-65702?
CVE-2026-65702 is a vulnerability with a CVSS score of 8.6 (HIGH). Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON fi...
How severe is CVE-2026-65702?
CVE-2026-65702 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-65702?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.