What is CVE-2026-65702?
CVE-2026-65702 is a path traversal vulnerability in the FileSystemConversationStore persistence integration in Vanna up to version 2.0.2. It allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata outside the intended store. Users should immediately update Vanna to the latest version.
Azərbaycanca: CVE-2026-65702, Vanna 2.0.2 versiyasına qədər olan versiyalarda "FileSystemConversationStore" komponentində yol keçidi zəifliyidir. Bu boşluq autentifikasiya olunmamış uzaqdan hücumçulara fayl sistemi üzərində ixtiyari JSON faylları yazmağa və nəzərdə tutulan yaddaşdan kənar söhbət metadata-larını oxumağa imkan verir. Vanna istifadəçiləri dərhal ən son versiyaya yeniləmə aparmalıdır.
Related CVEs
link basis: same weakness class CWE-22
FAQ2
Which versions of Vanna are affected by CVE-2026-65702?
CVE-2026-65702 affects Vanna versions up to 2.0.2.
What can an unauthenticated remote attacker do by exploiting CVE-2026-65702?
An unauthenticated remote attacker can write JSON files to arbitrary filesystem locations and read conversation metadata outside the intended store.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.