EUVD-2026-37962
GHSA-fwh2-95jw-g4j6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable agent API with low-privilege caller controlling agent ID (PR:L); arbitrary file read/write yields high C/I/A with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs when building file paths. Attackers can include traversal sequences like ../ in agent IDs to read, write, or overwrite arbitrary files, enabling sensitive disclosure, denial of service, or code execution.
AnalysisAI
Path traversal in PraisonAI's MultiAgentMonitor component (versions <= 1.5.114) lets remote attackers who can supply agent identifiers read, write, or overwrite arbitrary files on the host by embedding '../' sequences in agent IDs. The flaw, disclosed by VulnCheck and tracked as GHSA-766v-q9x3-g744, enables information disclosure, denial of service, and potential code execution in multi-agent AI deployments; no public exploit identified at time of analysis but a detailed PoC is included in the advisory.
Technical ContextAI
PraisonAI is an open-source multi-agent orchestration framework (Python package praisonaiagents) used to build and monitor cooperating LLM agents. The vulnerable MultiAgentMonitor class (examples/context/12_multi_agent_context.py:106) constructs per-agent log/state file paths by concatenating a base_path with the caller-supplied agent ID without sanitizing or canonicalizing the result, the classic CWE-22 'Improper Limitation of a Pathname to a Restricted Directory' pattern. A companion issue in MultiAgentLedger (line 68) keys ledger instances by raw agent ID, allowing context leakage when IDs collide - both stem from treating agent IDs as trusted identifiers rather than untrusted input.
RemediationAI
Vendor-released patch: upgrade praisonaiagents to 1.5.115 or later (pip install --upgrade praisonaiagents), per GHSA-766v-q9x3-g744. Until upgrade is possible, treat agent IDs as untrusted input and reject any value containing path separators, '..', null bytes, or absolute paths before passing them to MultiAgentMonitor or MultiAgentLedger; alternatively, normalize the constructed path and verify it resolves under base_path using os.path.realpath comparison (trade-off: requires a code patch and may break agents using slashes in IDs intentionally). For multi-tenant ledger isolation, prepend a tenant- or session-scoped prefix to agent IDs so collisions cannot leak context (trade-off: existing IDs must be migrated). Run the PraisonAI process under a least-privileged OS user with no write access outside its data directory to limit blast radius if exploitation succeeds.
PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/serve
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today