AIKIDO-2026-736664

TL;DR

The DirectoryPromptRegistry in banks builds prompt file paths by interpolating the prompt name and version directly into a filesystem path without validation. Calling set() with a name or version that contains an absolute path or .. segments writes the prompt file outside the registry root, and loading a crafted index.json reconstructs stored paths the same unsafe way. An attacker who can influence stored prompt names, versions, or the on-disk index can write or overwrite files outside the intended directory. The fix adds _resolve_prompt_file(), which rejects absolute and dot-segment names and versions and enforces that the resolved path stays within the registry root.