{"id":"RHLW-2026-4aeb7d27ff8d2e0d","summary":"Lightwell Security Advisory: banks 2.5.0+rhlw.1","details":"Red Hat Lightwell has released banks 2.5.0+rhlw.1 with a backported security fix.\n\nCVE-2026-107716: Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry\n\nThis patched artifact is a drop-in replacement for banks 2.5.0 from PyPI.","modified":"2026-11-10T08:30:02.387065701Z","published":"2026-11-06T21:43:43Z","upstream":["CVE-2026-107716","GHSA-556j-vv39-8rqv"],"references":[{"type":"WEB","url":"https://github.com/masci/banks/releases/tag/v2.5.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107716.json"},{"type":"ADVISORY","url":"https://github.com/masci/banks/security/advisories/GHSA-556j-vv39-8rqv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107716"},{"type":"FIX","url":"https://github.com/masci/banks/commit/23ed13e50b4e217693fa5f9c30943fac8a41582f"},{"type":"FIX","url":"https://github.com/masci/banks/pull/79"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-556j-vv39-8rqv"}],"affected":[{"package":{"name":"banks","ecosystem":"Red Hat Lightwell:PyPI","purl":"pkg:pypi/banks"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0+rhlw.1"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.1.0","0.1.1","0.2.0","0.3.0","0.3.1","0.4.1","0.5.0","0.6.0","1.0.0","1.1.0","1.2.0","1.2.1","1.3.0","1.4.0","1.5.0","1.6.0","1.6.1","1.7.0","1.7.1","1.8.0","2.0.0","2.1.0","2.1.1","2.1.2","2.1.3","2.2.0","2.3.0","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.5.0"],"database_specific":{"lightwell":{"backport_base_version":"2.5.0","remediated_version":"2.5.0+rhlw.1","repository_url":"https://packages.redhat.com/lightwell/python/remediated/"},"source":"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-4aeb7d27ff8d2e0d.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"}],"credits":[{"name":"Red Hat Lightwell","type":"REMEDIATION_DEVELOPER"}]}