CVE-2026-5595: Griptape-AI Path Traversal Vulnerability

CVE-2026-5595 Overview

A path traversal vulnerability has been identified in griptape-ai griptape version 0.19.4. The vulnerability exists within the FileManagerTool component, specifically affecting the load_files_from_disk, list_files_from_disk, save_content_to_file, and save_memory_artifacts_to_disk functions. An attacker can exploit this flaw remotely to traverse directories outside the intended file system boundaries, potentially accessing or modifying sensitive files on the target system.

Critical Impact

Remote attackers can exploit this path traversal vulnerability to read, write, or list files outside the intended directory scope, potentially leading to information disclosure, data tampering, or unauthorized access to sensitive system files.

Affected Products

• griptape-ai griptape version 0.19.4
• FileManagerTool component

Discovery Timeline

• April 5, 2026 - CVE-2026-5595 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-5595

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The FileManagerTool component in griptape-ai griptape fails to properly sanitize user-supplied input before using it in file system operations. This allows an attacker to craft malicious input containing directory traversal sequences (such as ../) to escape the intended working directory and access arbitrary locations on the file system.

The vulnerability is remotely exploitable, requiring only low privileges to attempt exploitation. The exploit has been publicly disclosed, and the vendor was contacted but did not respond to the disclosure.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the FileManagerTool component. The affected functions—load_files_from_disk, list_files_from_disk, save_content_to_file, and save_memory_artifacts_to_disk—do not properly validate or sanitize file path inputs. This allows path traversal sequences to be processed, enabling attackers to navigate outside the intended directory structure.

Attack Vector

The attack can be performed remotely over the network. An attacker with low-level privileges can submit specially crafted file path inputs containing traversal sequences such as ../ or encoded variants to the vulnerable FileManagerTool functions. This manipulation allows the attacker to:

• Read sensitive files outside the designated directory using load_files_from_disk
• List directory contents of arbitrary locations using list_files_from_disk
• Write malicious content to arbitrary file paths using save_content_to_file or save_memory_artifacts_to_disk

The vulnerability allows unauthorized file system access by bypassing intended directory restrictions. An attacker could supply input such as ../../etc/passwd or similar path traversal payloads to access files outside the application's working directory. Technical details are available in the GitHub Issue Report.

Detection Methods for CVE-2026-5595

Indicators of Compromise

• File access logs showing unusual path patterns containing ../ sequences
• Unexpected file read or write operations targeting sensitive system files or directories outside the application's scope
• Application logs revealing path traversal attempts in FileManagerTool function parameters

Detection Strategies

• Monitor application logs for path traversal patterns including ../, ..\\, or URL-encoded equivalents (%2e%2e%2f)
• Implement file integrity monitoring on critical system files and directories
• Deploy web application firewalls (WAF) with rules to detect and block path traversal payloads
• Review audit logs for anomalous file system access patterns originating from the griptape application

Monitoring Recommendations

• Enable verbose logging for the FileManagerTool component to capture all file operation requests
• Set up alerts for any file access attempts outside the designated working directories
• Monitor for outbound data exfiltration that may indicate successful exploitation
• Implement runtime application self-protection (RASP) to detect path traversal attempts in real-time

How to Mitigate CVE-2026-5595

Immediate Actions Required

• Restrict network access to systems running vulnerable griptape versions until patching is possible
• Implement strict input validation to reject any file paths containing traversal sequences
• Apply principle of least privilege to the griptape application's file system permissions
• Consider disabling or restricting the FileManagerTool component if not required for operations

Patch Information

At the time of publication, no official patch has been released by the vendor. The vendor was contacted regarding this disclosure but did not respond. Organizations should monitor the VulDB entry and griptape-ai project releases for security updates.

Workarounds

• Implement a whitelist of allowed file paths and directories that the FileManagerTool can access
• Deploy application-level input sanitization to strip or reject path traversal sequences before processing
• Use chroot jails or containerization to limit the file system scope accessible to the application
• Apply restrictive file system permissions to prevent the application from accessing sensitive files

# Example: Restrict file system access using containerization
# Limit the griptape application to only access designated directories
docker run --read-only \
  -v /app/data:/app/data:rw \
  -v /app/config:/app/config:ro \
  --security-opt no-new-privileges \
  griptape-app:0.19.4