CVE-2026-7217: Deepractice PromptX Path Traversal Flaw

CVE-2026-7217 Overview

A path traversal vulnerability has been identified in Deepractice PromptX up to version 2.4.0. The vulnerability exists in the Document File Handler component, specifically affecting multiple functions including read_docx, read_xlsx, read_pptx, list_xlsx_sheets, and read_pdf within the file packages/mcp-office/src/index.ts. An attacker can manipulate the path argument to achieve absolute path traversal, potentially allowing unauthorized access to files outside the intended directory structure. This vulnerability can be exploited remotely, and exploit details have been publicly disclosed.

Critical Impact
Remote attackers can exploit path traversal to read arbitrary files on the system, potentially exposing sensitive configuration data, credentials, or other confidential information stored on the server.

Affected Products

Deepractice PromptX versions up to 2.4.0
PromptX MCP-Office component (packages/mcp-office/src/index.ts)
Document File Handler functions (read_docx, read_xlsx, read_pptx, list_xlsx_sheets, read_pdf)

Discovery Timeline

April 28, 2026 - CVE-2026-7217 published to NVD
April 28, 2026 - Last updated in NVD database

Technical Details for CVE-2026-7217

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal or directory traversal. The flaw resides in the Document File Handler component of the PromptX MCP-Office package, which processes various document formats including DOCX, XLSX, PPTX, and PDF files.

The vulnerable functions fail to properly sanitize or validate the path argument before using it to access files on the filesystem. This allows an attacker to craft malicious input containing directory traversal sequences (such as ../) or absolute paths to escape the intended directory scope and access arbitrary files on the system.

The vulnerability is exploitable over the network without requiring authentication or user interaction, making it particularly concerning for internet-facing deployments of PromptX.

Root Cause

The root cause of this vulnerability is insufficient input validation on the path parameter in multiple document handling functions. The application fails to implement proper path canonicalization and boundary checking, allowing user-supplied path values to reference files outside the designated document directory. Without sanitization of path traversal characters or verification that the resolved path remains within the expected directory hierarchy, attackers can leverage this oversight to access sensitive system files.

Attack Vector

The attack is network-based, allowing remote exploitation without authentication. An attacker can send crafted requests to the affected functions with manipulated path arguments containing traversal sequences. By including sequences like ../ or providing absolute file paths, the attacker can direct the application to read files from arbitrary locations on the filesystem.

For example, an attacker might attempt to access sensitive configuration files, environment variables, or other confidential data stored on the server. The publicly disclosed nature of this exploit increases the urgency for affected organizations to apply mitigations. Additional technical details are available in the GitHub Issue #571 and VulDB Vulnerability #359817.

Detection Methods for CVE-2026-7217

Indicators of Compromise

Requests to document handling endpoints containing path traversal sequences such as ../, ..\\, or encoded variants like %2e%2e%2f
Access logs showing attempts to read system files (e.g., /etc/passwd, /etc/shadow, configuration files)
Unusual file access patterns from the PromptX application process accessing directories outside its normal scope
Error messages or stack traces indicating file access attempts to restricted system paths

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in request parameters targeting document handling endpoints
Monitor application logs for repeated failures or anomalies in the read_docx, read_xlsx, read_pptx, list_xlsx_sheets, and read_pdf functions
Deploy file integrity monitoring on sensitive system files and directories to detect unauthorized access attempts
Use runtime application self-protection (RASP) solutions to identify path traversal exploitation attempts in real-time

Monitoring Recommendations

Enable verbose logging for the MCP-Office component to capture all file access attempts with full path information
Configure alerts for access to sensitive system directories or files outside the application's designated document root
Review network traffic to PromptX instances for suspicious patterns that may indicate automated exploitation attempts
Implement endpoint detection and response (EDR) monitoring on servers hosting PromptX deployments

How to Mitigate CVE-2026-7217

Immediate Actions Required

Restrict network access to PromptX instances to trusted IP addresses or internal networks only until a patch is available
Implement input validation at the network perimeter using WAF rules to block path traversal sequences
Review and limit filesystem permissions for the PromptX application user account to minimize the impact of potential exploitation
Monitor the PromptX GitHub repository for security updates and patch releases

Patch Information

At the time of publication, no official patch has been released by the PromptX project. The vulnerability was reported through GitHub Issue #571, but the project has not yet responded. Organizations using affected versions should implement compensating controls and monitor for vendor updates. Consider subscribing to the PromptX repository notifications for security-related announcements.

Workarounds

Deploy a reverse proxy or WAF in front of PromptX instances configured to filter and reject requests containing path traversal patterns
Implement chroot or container isolation to restrict the PromptX application's filesystem access to a dedicated directory
Use file access control mechanisms (SELinux, AppArmor) to limit which files and directories the PromptX process can access
Temporarily disable or restrict access to the vulnerable document handling functions if they are not critical to operations

bash

# Example: Nginx reverse proxy configuration to block path traversal attempts
location /api/documents {
    # Block common path traversal patterns
    if ($request_uri ~* "\.\./") {
        return 403;
    }
    if ($request_uri ~* "\.\.\\") {
        return 403;
    }
    if ($request_uri ~* "%2e%2e") {
        return 403;
    }
    proxy_pass http://promptx-backend;
}