CVE-2026-22661
prompts.chat Path Traversal via Skill File Handling
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
11th
prompts.chat prior to commit 0f8d4c3 contains a path traversal vulnerability in skill file handling that allows attackers to write arbitrary files to the client system by crafting malicious ZIP archives with unsanitized filenames containing path traversal sequences. Attackers can exploit missing server-side filename validation to inject path traversal sequences ../ into skill file archives, which when extracted by vulnerable tools write files outside the intended directory and overwrite shell initialization files to achieve code execution.
| CWE | CWE-22 |
| Vendor | f |
| Product | prompts.chat |
| Published | Apr 3, 2026 |
| Last Updated | Apr 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for f prompts.chat
Be the first to know when new high vulnerabilities affecting f prompts.chat are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
f / prompts.chat
0 < 0f8d4c381abd7b2d7478c9fdee9522149c2d65e5
References
Credits
Mehmet Ince @mdisec