Vanna AI version 2.0.2 contains a path‑traversal vulnerability in the FileSystemConversationStore that lets unauthenticated remote attackers include traversal sequences in the conversation_id parameter sent to the chat API. The server uses this identifier to read and write JSON conversation files without proper sanitization, enabling arbitrary file write with attacker‑controlled content and unauthorized file read outside the intended store base directory, classified as CWE‑22.

The affected product is Vanna AI (vanna package) version 2.0.2. No other vendors or products are affected according to the CNA data.

The flaw has a CVSS score of 8.8, indicating high severity. The EPSS score is below 1%, indicating a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending unauthenticated requests to the public chat API endpoints, inserting path‑traversal sequences in the conversation_id parameter to escape the base directory during read and write operations. This allows writing arbitrary JSON files to any filesystem path and reading unintended files from the server.