Which versions of Vanna are affected by CVE-2026-65702?

Vanna (open-source AI SQL agent) versions through 2.0.2 contain a critical path traversal vulnerability allowing unauthenticated attackers to read and write arbitrary files on deployed systems.

Is there a public PoC exploit available for CVE-2026-65702?

Yes, a public proof-of-concept exploit is available for CVE-2026-65702. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-65702?

Within 24 hours, identify all systems running Vanna through version 2.0.2 and isolate or disable affected instances if operationally feasible; review filesystem and application logs for exploitation indicators or path traversal attempts. Within 7 days, enforce network-based access controls restricting Vanna API endpoints to authorized internal sources; reconfigure Vanna to run with least-privilege filesystem access (disable FileSystemConversationStore and migrate to an alternative conversation storage backend, or restrict to read-only root filesystem and minimal explicit volume mounts). Within 30 days, monitor the Vanna project repository and security advisories for a patched release; upon availability of version 2.0.3 or later, validate in staging and deploy to production within 48 hours of confirmation.

Vanna CVE-2026-65702

Q: What is the CVSS score of CVE-2026-65702?

CVE-2026-65702 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-48335 HIGH

Path Traversal (CWE-22)

2026-07-23 VulnCheck

GHSA-xxc9-8wc2-p57g

Path Traversal Vanna Vanna Ai

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Unauthenticated network endpoint (AV:N/AC:L/PR:N/UI:N); arbitrary file write drives I:H, limited metadata read gives C:L, and write-induced disruption A:L.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:46 vuln.today

CVE Published

Jul 23, 2026 - 17:09 cve.org

HIGH 8.8

DescriptionCVE.org

Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended store base directory. Attackers can supply path traversal sequences in the conversation_id parameter submitted to the unauthenticated chat API endpoints to escape the base directory during both write and read operations, enabling arbitrary file write with attacker-controlled content and unauthorized file read on the server filesystem.

AnalysisAI

Arbitrary file write and unauthorized file read in Vanna (the open-source AI SQL agent) through version 2.0.2 allows unauthenticated remote attackers to escape the FileSystemConversationStore base directory by injecting path traversal sequences into the conversation_id parameter of the chat API. Because the affected endpoints require no authentication, an attacker can write attacker-controlled JSON to arbitrary filesystem locations and read conversation metadata from outside the intended store - publicly available exploit code exists and the flaw was reported by VulnCheck. No CISA KEV listing is present, so there is no public exploit identified as being actively used in the wild.

Technical ContextAI

Vanna is a Python-based retrieval-augmented framework that lets users ask natural-language questions and generates SQL against a database, exposing a chat/conversation API. The vulnerable component is the FileSystemConversationStore persistence integration, which serializes conversation state to JSON files on disk under a configured base directory. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal): the conversation_id supplied by the client is used to construct the on-disk file path without canonicalization or containment validation, so sequences such as '../' let the resolved path escape the store base directory during both write (save) and read (load) operations. The affected product is identified by CPE cpe:2.3:a:vanna-ai:vanna:*:*:*:*:*:*:*:* for all versions up to and including 2.0.2.

RemediationAI

No vendor-released patch version is identified in the available data, so upgrade to a fixed release once the Vanna maintainers publish one and monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/vanna-path-traversal-via-filesystemconversationstore) for the corrected version. As compensating controls, avoid exposing the chat API to untrusted networks by placing it behind authentication and a reverse proxy or network ACLs; if authentication cannot be added, restrict access to the chat endpoints at the perimeter. Where feasible, switch away from FileSystemConversationStore to a non-filesystem conversation store to remove the file-path sink entirely, or run the service as an unprivileged user in a container/chroot with a read-only filesystem outside the store directory so traversal cannot reach sensitive paths - the trade-off is that hardening the runtime does not stop writes within the writable store and may require operational changes. Validate and canonicalize conversation_id server-side (reject any value containing path separators or traversal sequences) if you maintain a local fork.