The vulnerability is a path traversal flaw that allows an attacker to supply a template variable that resolves to a file path containing traversal sequences (../). Through the money‑laden media filters in Banks, the untrusted value is passed directly to open(file_path, "rb") without any sanitization, canonicalization, or directory restriction. This flaw permits read access to any file accessible to the Python process, such as configuration files, SSH keys, cloud credentials, source code, /etc/passwd, and /etc/shadow, and the contents are returned base64‑encoded in the rendered prompt output, making exfiltration straightforward.

The affected product is Banks released by Masci. All versions prior to 2.4.4 contain the vulnerability; version 2.4.4 and later contain a fix that removes the path traversal path resolution in the media filters.

The CVSS score of 7.5 indicates a high severity for this arbitrary read. The EPSS score is 0.00335 (<1%), indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. An attacker who can control template variables—such as a user of an application that feeds user data into a Banks prompt—can exploit the flaw by inserting path traversal segments to read arbitrary files. Because the read data is base64‑encoded in the output, exfiltration is trivial and requires no further action by the attacker beyond crafting the prompt. This weakness can compromise confidentiality and, depending on the file accessed, potentially affect system integrity.