EUVD-2026-28643
GHSA-9q28-ghcr-c4x3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member's name for absolute paths, .. segments, and resolved-path escape - but does not validate member.linkname, does not reject symlink/hardlink members, and calls tar.extractall(dest_dir) without filter="data". A bundle that contains a symlink with a name inside dest_dir but a linkname pointing outside it, followed by a regular file whose path traverses through the just-created symlink, escapes dest_dir and lets the attacker write arbitrary content to an attacker-chosen location on the victim's filesystem. This issue has been patched in version 4.6.37.
AnalysisAI
Path traversal via symlink exploitation in PraisonAI multi-agent teams system allows remote unauthenticated attackers to write arbitrary files outside intended directories during recipe operations (pull/publish/unpack). The _safe_extractall helper validates archive member names but fails to validate symlink targets (linkname attribute), enabling attackers to craft malicious tar bundles containing symlinks pointing outside extraction directories followed by files traversing through those symlinks. Affects versions prior to 4.6.37. EPSS data unavailable, no CISA KEV listing, and no public POC identified at time of analysis, suggesting limited observed exploitation despite network-accessible attack vector.
Technical ContextAI
PraisonAI is a multi-agent orchestration framework using recipe bundles (tar archives) for component distribution. The vulnerability exists in the _safe_extractall function used across recipe pull, publish, and unpack workflows. While the function validates tar member.name for path traversal patterns (absolute paths, .. segments, resolved-path escape), it omits validation of member.linkname attributes on symlink and hardlink entries. Python's tarfile.extractall() is invoked without filter='data' parameter (introduced in Python 3.12 to prevent extraction of special file types). This maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The attack exploits the tar format's support for symbolic links as metadata entries that create filesystem links during extraction, combined with subsequent file writes that resolve through those links.
RemediationAI
Upgrade to PraisonAI version 4.6.37 or later, which patches the _safe_extractall function to validate symlink targets and implements proper tar extraction filtering. The fix is available through standard PraisonAI update channels and detailed in GitHub security advisory GHSA-9q28-ghcr-c4x3 at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9q28-ghcr-c4x3. For environments unable to immediately upgrade, implement strict input validation to reject recipe bundles from untrusted sources and restrict filesystem permissions for the PraisonAI process using principle of least privilege (confine write access to dedicated recipe directories only), though these compensating controls do not eliminate the vulnerability and may break legitimate recipe functionality requiring broader filesystem access. Network-level controls blocking recipe upload endpoints from untrusted networks reduce attack surface but prevent legitimate remote recipe operations.
We need answer JSON only. Need obey. Need analyze CVE. Need synthesize all data. Need not copy description. Need include
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today