CVE-2026-22661: Path Traversal in prompts.chat

The vulnerability lies in how prompts.chat handles skill files, which are likely used to extend the application's functionality. An attacker can craft a malicious ZIP archive containing skill files with filenames that include path traversal sequences (e.g., ../). When the application extracts these archives, it will write files outside the intended directory. This could allow an attacker to overwrite critical system files, such as shell initialization files (e.g., .bashrc, .zshrc), leading to remote code execution. The impact is significant, as successful exploitation could grant the attacker complete control over the client system where prompts.chat is running. This is particularly concerning if prompts.chat is deployed in a server environment or used to process user-supplied data.

1. Reserved2026-01-08
2. Published2026-04-03
3. Modified2026-04-06
4. EPSS updated2026-04-11

The primary mitigation is to upgrade to version 0f8d4c381abd7b2d7478c9fdee9522149c2d65e5 or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds. One approach is to implement strict filename validation on the server-side before extracting ZIP archives. This should include sanitizing filenames to remove or reject any path traversal sequences (e.g., ../, ./). Another option is to restrict the directories where skill files can be extracted to a tightly controlled sandbox. Monitor system files for unexpected modifications, particularly shell initialization files. After upgrading, confirm the fix by attempting to upload a ZIP archive containing a malicious skill file with a path traversal sequence in its filename; the application should reject the upload or extract the file to the expected location.