File Access Vulnerability in The Pocket/PocketFlow Cookbook Example

CVE-2026-55747

What is CVE-2026-55747?

The Pocket/PocketFlow has a file access vulnerability in its cookbook example where the _path(workdir, p) helper lacks proper security checks. This vulnerability enables potential file read and write operations beyond the designated working directory. Specifically, the use of os.path.join(workdir, p) fails to validate or canonicalize paths, allowing malicious users to exploit absolute paths or directory traversal sequences. This poses a risk for applications that might adopt this pattern from the illustrative cookbook into real-world environments.

References