CVE-2026-5595
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A path traversal vulnerability was found in griptape-ai griptape 0.19.4 in the FileManagerTool component. The functions load_files_from_disk, list_files_from_disk, save_content_to_file, and save_memory_artifacts_to_disk improperly validate paths, allowing remote attack. The exploit has been publicly disclosed and may be used.
Risk Assessment
An attacker can remotely read or write files outside the allowed directory, leading to data leakage or modification.
Recommendation
Immediately update griptape to a patched version or apply temporary restrictions to the FileManagerTool component.
Other vulnerabilities in griptape
See all- CVE-2026-5597Medium
Griptape version 0.19.4 has a path traversal vulnerability in the ComputerTool component. A remote attacker can manipulate the filename argument to access files outside the intended directory. An exploit has been published.
- CVE-2026-5596Medium
SQL Injection vulnerability in griptape 0.19.4. An unknown functionality in the file griptape/tools/sql/tool.py in the SqlTool component allows manipulation leading to SQL injection. The attack can be performed remotely, and the exploit is publicly available. The vendor did not respond.
Original NVD description (English source)
A security vulnerability has been detected in griptape-ai griptape 0.19.4. Affected by this vulnerability is the function load_files_from_disk/list_files_from_disk/save_content_to_file/save_memory_artifacts_to_disk of the component FileManagerTool. Such manipulation leads to path traversal. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS