Prompty: Arbitrary file read via file reference expansion
Prompty loaders expanded ${file:…} references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to the process.