{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-22661/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-22661"}],"_cs_exploited":false,"_cs_products":[],"_cs_severities":["high"],"_cs_tags":["path-traversal","file-write","code-execution","cve-2026-22661","prompts.chat","linux"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eprompts.chat, a software application, is vulnerable to a path traversal attack (CVE-2026-22661) in versions prior to commit 0f8d4c3. This vulnerability stems from insufficient server-side validation of filenames within skill file archives. A remote attacker can exploit this by crafting malicious ZIP archives that contain filenames with path traversal sequences (e.g., ../). When a vulnerable prompts.chat instance extracts these archives, the lack of proper sanitization allows the attacker to write files to arbitrary locations on the file system, potentially overwriting critical system files and achieving arbitrary code execution. This poses a significant risk to system integrity and confidentiality.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker crafts a malicious ZIP archive containing a specially crafted skill file.\u003c/li\u003e\n\u003cli\u003eThe filenames within the ZIP archive include path traversal sequences such as \u003ccode\u003e../\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker uploads the malicious ZIP archive to the prompts.chat application.\u003c/li\u003e\n\u003cli\u003eprompts.chat processes the uploaded ZIP archive without properly sanitizing the filenames.\u003c/li\u003e\n\u003cli\u003eThe application extracts the contents of the ZIP archive, writing files to locations specified in the malicious filenames.\u003c/li\u003e\n\u003cli\u003ePath traversal sequences in the filenames allow the attacker to write files outside the intended extraction directory.\u003c/li\u003e\n\u003cli\u003eThe attacker overwrites shell initialization files (e.g., \u003ccode\u003e.bashrc\u003c/code\u003e, \u003ccode\u003e.profile\u003c/code\u003e, \u003ccode\u003e.bash_profile\u003c/code\u003e) or other executable files.\u003c/li\u003e\n\u003cli\u003eWhen a user logs in or a new shell is spawned, the overwritten initialization file executes malicious code, granting the attacker arbitrary code execution on the system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-22661 allows an attacker to write arbitrary files to the client system, leading to potential overwrite of sensitive system files and arbitrary code execution. The vulnerability affects systems running vulnerable versions of prompts.chat. The impact includes complete compromise of the system, data theft, and further propagation of malicious activities.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eApply the patch by upgrading to commit 0f8d4c3 or later to remediate CVE-2026-22661.\u003c/li\u003e\n\u003cli\u003eImplement server-side filename validation and sanitization to prevent path traversal attacks when handling ZIP archives within prompts.chat.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious requests containing path traversal sequences in filenames as identified by the provided rules.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-04-04T12:00:00Z","date_published":"2026-04-04T12:00:00Z","id":"/briefs/2026-04-prompts-chat-traversal/","summary":"A path traversal vulnerability exists in prompts.chat prior to commit 0f8d4c3, allowing attackers to write arbitrary files to the client system by crafting malicious ZIP archives with unsanitized filenames.","title":"prompts.chat Path Traversal Vulnerability (CVE-2026-22661)","url":"https://feed.craftedsignal.io/briefs/2026-04-prompts-chat-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed — Cve-2026-22661","version":"https://jsonfeed.org/version/1.1"}