Summary
CVE-2026-65702 is a path traversal vulnerability (CWE-22) in Vanna (vanna-ai) through version 2.0.2, affecting the FileSystemConversationStore persistence integration. Unauthenticated remote attackers can supply path traversal sequences in the conversation_id parameter of the unauthenticated chat API endpoints to write attacker-controlled JSON files to arbitrary filesystem locations or read files outside the intended base directory. The vulnerability carries a CVSS v3.1 score of 8.6 (HIGH).
Technical details
- Root cause:
FileSystemConversationStoredirectly concatenates the client-suppliedconversation_idvalue onto a base directory path (self.base_dir / conversation_id) without any sanitization, canonicalization, or containment check. This is a classic unsanitized path join pattern (CWE-22). - Trigger conditions: Any HTTP POST request to the unauthenticated chat API endpoints with a
conversation_idvalue containing path traversal sequences (e.g.,../../../../tmp/target). No authentication or user interaction is required. - Attack vector: Network-accessible; exploitable via three unauthenticated endpoints:
POST /api/vanna/v2/chat_sse,POST /api/vanna/v2/chat_poll, andPOST /api/vanna/v2/chat_websocket. Theconversation_idfield in theChatRequestmodel (defined insrc/vanna/servers/base/models.py) is passed directly to filesystem operations with no validation. - Arbitrary file write impact: The server calls
mkdir(parents=True)and writes attacker-controlled JSON content to the traversed path, enabling deposit of malicious files in writable system locations such as cron directories, configuration autoload paths, or web roots — which can be leveraged to escalate to remote code execution. - Arbitrary file read impact: The
get_conversationmethod readsmetadata.jsonfrom the traversed path before validating user ownership, enabling unauthorized reading of server filesystem files and potential exposure of credentials, API keys, and sensitive configuration data.
Affected software
- vanna-ai/vanna — all versions through 2.0.2
Severity
CVSS v3.1 base score: 8.6 (HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Mitigation and recommended actions
- No vendor patch is available. The vanna-ai repository was archived on March 29, 2026, and no remediated release has been published.
- Network mitigation: Restrict internet access to Vanna’s chat API endpoints at the network perimeter (firewall, reverse proxy, or API gateway). Prevent unauthenticated external access to
/api/vanna/v2/routes. - Application-level workaround: If
FileSystemConversationStoreis in use, disable or replace it with a storage backend that does not derive filesystem paths from client-controlled input. Vanna’s codebase contains a properly contained path resolution pattern inLocalFileSystem._resolve_paththat can serve as a reference for a custom safe implementation. - Input validation (custom deployments): Enforce server-side generation of conversation IDs (e.g., UUID v4) and reject any client-supplied
conversation_idvalues containing/, “,.., or null bytes.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

