CVE-2026-5595

BRIEFING NOTE - CVE-2026-5595 A path traversal vulnerability has been identified in griptape-ai griptape version 0.19.4, specifically within the FileManagerTool component's file operation functions including load_files_from_disk, list_files_from_disk, save_content_to_file, and save_memory_artifacts_to_disk. This vulnerability allows attackers to access, modify, or interact with files outside the intended directory boundaries, potentially exposing sensitive data or system files. The vulnerability carries a CVSS 3.1 score of 6.3 (MEDIUM severity) with a network attack vector, low attack complexity, and low privilege requirements. The attack requires user authentication but no user interaction, affecting confidentiality, integrity, and availability with limited scope. The EPSS score of 0.000680 indicates this vulnerability is not currently being widely exploited compared to other CVEs. The exploit code has been disclosed publicly, creating potential risk for organizations using affected versions. However, the vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hotlists, suggesting minimal active exploitation in the wild at this time. The vendor was contacted early about the disclosure but failed to provide a response, indicating no official patch has been released.