CVE-2026-5595
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A path traversal vulnerability was found in griptape-ai griptape 0.19.4 in the FileManagerTool component. The functions load_files_from_disk, list_files_from_disk, save_content_to_file, and save_memory_artifacts_to_disk improperly validate paths, allowing remote attack. The exploit has been publicly disclosed and may be used.
Risk Assessment
An attacker can remotely read or write files outside the allowed directory, leading to data leakage or modification.
Recommendation
Immediately update griptape to a patched version or apply temporary restrictions to the FileManagerTool component.
Original NVD description (English source)
A security vulnerability has been detected in griptape-ai griptape 0.19.4. Affected by this vulnerability is the function load_files_from_disk/list_files_from_disk/save_content_to_file/save_memory_artifacts_to_disk of the component FileManagerTool. Such manipulation leads to path traversal. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.