CVE-2026-7217 — Deepractice PromptX Path Traversal

title: CVE-2026-7217 - Deepractice PromptX Path Traversal in Document Handling
id: scw-2026-04-28-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2026-7217 by targeting the Document File Handler component in Deepractice PromptX. The rule looks for specific URI paths and query parameters indicative of path traversal attempts to access sensitive files via functions like read_docx, read_xlsx, etc.
author: SCW Feed Engine (AI-generated)
date: 2026-04-28
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-7217/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/packages/mcp-office/src/index.ts'
      cs-uri-query|contains:
          - 'read_docx'
          - 'read_xlsx'
          - 'read_pptx'
          - 'list_xlsx_sheets'
          - 'read_pdf'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse