PT-2026-35649 · Deepractice · Promptx

Brucejin · Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-7217

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Deepractice PromptX versions prior to 2.4.0

Description An absolute path traversal issue exists in the Document File Handler component within the file packages/mcp-office/src/index.ts. The flaw occurs when the path argument is manipulated in the read docx(), read xlsx(), read pptx(), list xlsx sheets(), or read pdf() functions, allowing for remote execution of the attack.

Recommendations As a temporary workaround, restrict access to the read docx(), read xlsx(), read pptx(), list xlsx sheets(), and read pdf() functions until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-36

Related Identifiers

CVE-2026-7217

Affected Products

Promptx

References · 8

• 🔥 https://github.com/Deepractice/PromptX/issues/571 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7217 · Security Note
• https://vuldb.com/vuln/359817 · Note
• https://twitter.com/CVEarity/status/2049110728104464634 · Twitter Post
• https://github.com/Deepractice/PromptX · Note
• https://t.me/CVEtracker/52033 · Telegram Post
• https://vuldb.com/vuln/359817/cti · Note
• https://vuldb.com/submit/802120 · Note