Which versions of PraisonAI are affected by EUVD-2026-28643?

PraisonAI versions prior to 4.6.37 contain an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on affected systems during recipe…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-28643?

Yes, a public proof-of-concept exploit is available for EUVD-2026-28643. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate EUVD-2026-28643?

Within 24 hours: Identify all systems running PraisonAI and inventory current versions. Within 7 days: Contact PraisonAI vendor to confirm availability of patched version 4.6.37 or later; if available, begin staged testing in non-production environment. Within 30 days: Deploy patched version to all production instances; implement network-level restrictions to limit recipe pull/publish/unpack operations to trusted sources only; enable file system integrity monitoring on systems running PraisonAI to detect unauthorized file writes.

PraisonAI EUVD-2026-28643

Q: What is the CVSS score of EUVD-2026-28643?

EUVD-2026-28643 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-44340 HIGH

Path Traversal (CWE-22)

2026-05-08 security-advisories@github.com

GHSA-9q28-ghcr-c4x3

Path Traversal Praisonai Praison

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

May 08, 2026 - 15:17 EUVD

Analysis Generated

May 08, 2026 - 15:01 vuln.today

CVE Published

May 08, 2026 - 14:16 nvd

HIGH 8.7

DescriptionGitHub Advisory

PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member's name for absolute paths, .. segments, and resolved-path escape - but does not validate member.linkname, does not reject symlink/hardlink members, and calls tar.extractall(dest_dir) without filter="data". A bundle that contains a symlink with a name inside dest_dir but a linkname pointing outside it, followed by a regular file whose path traverses through the just-created symlink, escapes dest_dir and lets the attacker write arbitrary content to an attacker-chosen location on the victim's filesystem. This issue has been patched in version 4.6.37.

AnalysisAI

Path traversal via symlink exploitation in PraisonAI multi-agent teams system allows remote unauthenticated attackers to write arbitrary files outside intended directories during recipe operations (pull/publish/unpack). The _safe_extractall helper validates archive member names but fails to validate symlink targets (linkname attribute), enabling attackers to craft malicious tar bundles containing symlinks pointing outside extraction directories followed by files traversing through those symlinks. Affects versions prior to 4.6.37. EPSS data unavailable, no CISA KEV listing, and no public POC identified at time of analysis, suggesting limited observed exploitation despite network-accessible attack vector.

Technical ContextAI

PraisonAI is a multi-agent orchestration framework using recipe bundles (tar archives) for component distribution. The vulnerability exists in the _safe_extractall function used across recipe pull, publish, and unpack workflows. While the function validates tar member.name for path traversal patterns (absolute paths, .. segments, resolved-path escape), it omits validation of member.linkname attributes on symlink and hardlink entries. Python's tarfile.extractall() is invoked without filter='data' parameter (introduced in Python 3.12 to prevent extraction of special file types). This maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The attack exploits the tar format's support for symbolic links as metadata entries that create filesystem links during extraction, combined with subsequent file writes that resolve through those links.

RemediationAI

Upgrade to PraisonAI version 4.6.37 or later, which patches the _safe_extractall function to validate symlink targets and implements proper tar extraction filtering. The fix is available through standard PraisonAI update channels and detailed in GitHub security advisory GHSA-9q28-ghcr-c4x3 at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9q28-ghcr-c4x3. For environments unable to immediately upgrade, implement strict input validation to reject recipe bundles from untrusted sources and restrict filesystem permissions for the PraisonAI process using principle of least privilege (confine write access to dedicated recipe directories only), though these compensating controls do not eliminate the vulnerability and may break legitimate recipe functionality requiring broader filesystem access. Network-level controls blocking recipe upload endpoints from untrusted networks reduce attack surface but prevent legitimate remote recipe operations.