What is the CVSS score of CVE-2026-62663?

CVE-2026-62663 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Banks are affected by CVE-2026-62663?

Masci/banks Python templating library versions before 2.4.4 contain a critical file disclosure vulnerability allowing attackers who control template variables to read sensitive files including AWS…. A patch is available.

How to fix or mitigate CVE-2026-62663?

Within 24 hours, identify all production and development systems using masci/banks, determine their versions, and assess whether untrusted users or external systems can supply template variable values through APIs or other interfaces. Within 7 days, implement strict input validation to reject path traversal sequences (../) in template variables and restrict the process file system permissions to access only necessary directories; disable unused media filters. Within 30 days, implement defense-in-depth mitigations: run the Python process in a restricted container with no access to credential directories, isolate all secrets and SSH keys outside the application working directory, and establish monitoring for template variable logs containing suspicious patterns.

Banks CVE-2026-62663

EUVD-2026-51231 HIGH

Path Traversal (CWE-22)

2026-07-30 GitHub_M

Python Path Traversal Red Hat Banks Masci

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Untrusted template input is network-reachable and unauthenticated in the intended threat model, low complexity; pure arbitrary-file-read gives C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 30, 2026 - 18:03 EUVD

Analysis Generated

Jul 30, 2026 - 17:20 vuln.today

CVE Published

Jul 30, 2026 - 16:16 cve.org

HIGH 7.5

DescriptionCVE.org

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters (image, audio, video, document) in banks accept untrusted user input as file paths via Path(value) and pass them directly to open(file_path, "rb") without any path sanitization, canonicalization, or directory restriction. An attacker who controls template variables passed to a banks Prompt can use path traversal (../) to read arbitrary files accessible to the Python process-including .env files, SSH keys, cloud credentials, source code, /etc/passwd, and /etc/shadow-with the content returned base64-encoded in the rendered prompt output, making exfiltration trivial. This is particularly dangerous for applications that use banks to process user-provided template variables before sending prompts to an LLM. This issue has been fixed in version 2.4.4.

Articles & Coverage 1

News 3 New Python Vulnerabilities - 3 High Severity Jul 31, 2026

AnalysisAI

Arbitrary file disclosure in the Banks Python prompt-templating library (masci/banks) before 2.4.4 lets attackers who control template variables read any file the Python process can access. All four media filters (image, audio, video, document) wrap untrusted input in Path(value) and feed it straight to open(file_path, "rb") with no sanitization, so path traversal (../) reads files like .env, SSH keys, cloud credentials, source, /etc/passwd and /etc/shadow, returning them base64-encoded in the rendered prompt for trivial exfiltration. No public exploit identified at time of analysis and it is not in CISA KEV, but the fix in 2.4.4 is straightforward to reverse-engineer.

Technical ContextAI

Banks is a Python library that builds LLM prompts from a simple Jinja-style template language, where filters such as {{ var | image }} embed media by reading it from disk. The CPE cpe:2.3:a:masci:banks:*:*:*:*:*:*:*:* confirms the affected component is the masci 'banks' application/library across all versions prior to the fix. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the media filters construct a filesystem path directly from template variable content - Path(value) - and open it in binary mode without canonicalization (no realpath resolution), no allowlist/base-directory confinement, and no rejection of traversal sequences, so relative segments like ../ resolve against the process working directory and escape any intended media folder.

RemediationAI

Vendor-released patch: upgrade Banks to version 2.4.4, which fixes all four media filters (pin banks>=2.4.4 in requirements/pyproject and rebuild). Until you can upgrade, do not pass user-controlled or otherwise untrusted data into Banks template variables that reach the image, audio, video, or document filters; if media embedding is not required, avoid those filters entirely. As compensating controls, validate and canonicalize any path-like variable before rendering and reject values containing '../', absolute paths, or symlinks, and/or confine the filters to a dedicated media directory via an allowlist - the trade-off is added validation code and possible breakage of legitimate nested media paths. Running the Python process under a least-privilege account limits which files traversal can reach (side effect: none functional, but it does not stop the read itself). See the advisory GHSA-98rr-gvc9-3cjh (https://github.com/masci/banks/security/advisories/GHSA-98rr-gvc9-3cjh) for details.