Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-65702 – Arbitrary File Write via Path Traversal – Vanna AI (vanna-ai) through v2.0.2

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-65702 is a path traversal vulnerability (CWE-22) in Vanna (vanna-ai) through version 2.0.2, affecting the FileSystemConversationStore persistence integration. Unauthenticated remote attackers can supply path traversal sequences in the conversation_id parameter of the unauthenticated chat API endpoints to write attacker-controlled JSON files to arbitrary filesystem locations or read files outside the intended base directory. The vulnerability carries a CVSS v3.1 score of 8.6 (HIGH).

Technical details

  • Root cause: FileSystemConversationStore directly concatenates the client-supplied conversation_id value onto a base directory path (self.base_dir / conversation_id) without any sanitization, canonicalization, or containment check. This is a classic unsanitized path join pattern (CWE-22).
  • Trigger conditions: Any HTTP POST request to the unauthenticated chat API endpoints with a conversation_id value containing path traversal sequences (e.g., ../../../../tmp/target). No authentication or user interaction is required.
  • Attack vector: Network-accessible; exploitable via three unauthenticated endpoints: POST /api/vanna/v2/chat_sse, POST /api/vanna/v2/chat_poll, and POST /api/vanna/v2/chat_websocket. The conversation_id field in the ChatRequest model (defined in src/vanna/servers/base/models.py) is passed directly to filesystem operations with no validation.
  • Arbitrary file write impact: The server calls mkdir(parents=True) and writes attacker-controlled JSON content to the traversed path, enabling deposit of malicious files in writable system locations such as cron directories, configuration autoload paths, or web roots — which can be leveraged to escalate to remote code execution.
  • Arbitrary file read impact: The get_conversation method reads metadata.json from the traversed path before validating user ownership, enabling unauthorized reading of server filesystem files and potential exposure of credentials, API keys, and sensitive configuration data.

Affected software

  • vanna-ai/vanna — all versions through 2.0.2

Severity

CVSS v3.1 base score: 8.6 (HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Mitigation and recommended actions

  • No vendor patch is available. The vanna-ai repository was archived on March 29, 2026, and no remediated release has been published.
  • Network mitigation: Restrict internet access to Vanna’s chat API endpoints at the network perimeter (firewall, reverse proxy, or API gateway). Prevent unauthenticated external access to /api/vanna/v2/ routes.
  • Application-level workaround: If FileSystemConversationStore is in use, disable or replace it with a storage backend that does not derive filesystem paths from client-controlled input. Vanna’s codebase contains a properly contained path resolution pattern in LocalFileSystem._resolve_path that can serve as a reference for a custom safe implementation.
  • Input validation (custom deployments): Enforce server-side generation of conversation IDs (e.g., UUID v4) and reject any client-supplied conversation_id values containing /, “, .., or null bytes.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge