RHLW-2026-4aeb7d27ff8d2e0d: Lightwell Security Advisory: banks 2.5.0+rhlw.1
Red Hat Lightwell has released banks 2.5.0+rhlw.1 with a backported security fix.
CVE-2026-107716: Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
This patched artifact is a drop-in replacement for banks 2.5.0 from PyPI.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/banksto a version that resolves this vulnerability.Fixed in 2.5.0+rhlw.1 - Upgrade
Upgrade
banksto a version that resolves this vulnerability.Fixed in 2.5.0+rhlw.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using red-hat-lightwell/banks version 2.5.0 are the stated affected baseline. The advisory identifies 2.5.0+rhlw.1 as the patched drop-in replacement.
What could an attacker achieve?
The flaw involves symlink traversal in DirectoryPromptRegistry and can lead to arbitrary file disclosure or overwrite. The supplied vector indicates local access and low privileges are required, with no user interaction required.
What should be done to remediate the issue?
Replace banks 2.5.0 with banks 2.5.0+rhlw.1. The advisory states that the patched artifact is a drop-in replacement for the PyPI 2.5.0 artifact.