DirectoryPromptRegistry.set() in Banks permits an attacker to insert a crafted Prompt.name or Prompt.version that includes relative traversal or absolute path components. When these values are interpolated into a Path without canonicalization or containment checks, the resulting file path may resolve outside the intended registry root. If overwrite=True is used, the attacker can overwrite existing files or create new ones in any location writable by the application process. The malicious Prompt.name is persisted in index.json and reloaded by _load(), allowing the path to survive restarts and enabling persistent exploitation. Without mitigation, an attacker can write arbitrary data, including executable or configuration files, to the file system, potentially compromising application integrity or facilitating further attacks.

Affected systems are installations of Banks by Masci running any version prior to 2.4.5. The vulnerability is located in the src/banks/registries/directory.py module and is fixed in the 2.4.5 release.

The CVSS score of 6 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in CISA KEV, suggesting no publicly known exploitation at this time. The likely attack vector involves providing attacker‑controlled Prompt.name and Prompt.version fields through any interface that forwards request data into these fields, such as an API endpoint or a web form. Successful exploitation requires the application process to have permission to write to the targeted file locations, making it a potential local or remote risk depending on how the input interface is exposed.