CVE-2026-65702 Details

A path traversal vulnerability has been identified in Vanna versions through 2.0.2, specifically within the FileSystemConversationStore persistence integration. This vulnerability allows unauthenticated remote attackers to write JSON files containing attacker-controlled content to arbitrary locations on the filesystem. Additionally, it enables unauthorized reading of conversation metadata from outside the designated store base directory. Exploitation involves sending path traversal sequences in the conversation_id parameter to the unauthenticated chat API endpoints, bypassing directory restrictions during both write and read operations.

Validate and normalize the conversation_id parameter in the FileSystemConversationStore integration before using it to construct filesystem paths. Reject any ids containing path traversal sequences or null bytes, or enforce a strict format such as UUIDs or a specific regex pattern. After joining the path, verify that it remains within the base directory using a containment check. Consider generating conversation_ids on the server side instead of relying on client input, and implement ownership checks before accessing the filesystem.