Which versions of PraisonAI are affected by EUVD-2026-37962?

PraisonAI MultiAgentMonitor (versions ≤1.5.114) is vulnerable to remote file system compromise through a path traversal flaw with publicly available exploit code, exposing organizations to data…. A patch is available.

How to fix or mitigate EUVD-2026-37962?

Within 24 hours: Identify all systems running PraisonAI ≤1.5.114 and determine if MultiAgentMonitor is exposed to untrusted networks; document current file system permissions and access controls. Within 7 days: Deploy input validation to reject agent IDs containing path traversal sequences ('../'); implement file system access logging and monitoring for anomalous activity. Within 30 days: Contact PraisonAI vendor to confirm patch availability; upgrade to patched version when released or implement architectural mitigations such as running in isolated containers with restricted permissions.

PraisonAI EUVD-2026-37962

Q: What is the CVSS score of EUVD-2026-37962?

EUVD-2026-37962 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.7%.

| CVE-2026-56078 HIGH

Path Traversal (CWE-22)

2026-06-18 VulnCheck

GHSA-fwh2-95jw-g4j6

RCE Denial Of Service Path Traversal Praisonai

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable agent API with low-privilege caller controlling agent ID (PR:L); arbitrary file read/write yields high C/I/A with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 19, 2026 - 02:01 EUVD

Source Code Evidence Fetched

Jun 18, 2026 - 23:18 vuln.today

Analysis Generated

Jun 18, 2026 - 23:18 vuln.today

DescriptionCVE.org

PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs when building file paths. Attackers can include traversal sequences like ../ in agent IDs to read, write, or overwrite arbitrary files, enabling sensitive disclosure, denial of service, or code execution.

AnalysisAI

Path traversal in PraisonAI's MultiAgentMonitor component (versions <= 1.5.114) lets remote attackers who can supply agent identifiers read, write, or overwrite arbitrary files on the host by embedding '../' sequences in agent IDs. The flaw, disclosed by VulnCheck and tracked as GHSA-766v-q9x3-g744, enables information disclosure, denial of service, and potential code execution in multi-agent AI deployments; no public exploit identified at time of analysis but a detailed PoC is included in the advisory.

Technical ContextAI

PraisonAI is an open-source multi-agent orchestration framework (Python package praisonaiagents) used to build and monitor cooperating LLM agents. The vulnerable MultiAgentMonitor class (examples/context/12_multi_agent_context.py:106) constructs per-agent log/state file paths by concatenating a base_path with the caller-supplied agent ID without sanitizing or canonicalizing the result, the classic CWE-22 'Improper Limitation of a Pathname to a Restricted Directory' pattern. A companion issue in MultiAgentLedger (line 68) keys ledger instances by raw agent ID, allowing context leakage when IDs collide - both stem from treating agent IDs as trusted identifiers rather than untrusted input.

RemediationAI

Vendor-released patch: upgrade praisonaiagents to 1.5.115 or later (pip install --upgrade praisonaiagents), per GHSA-766v-q9x3-g744. Until upgrade is possible, treat agent IDs as untrusted input and reject any value containing path separators, '..', null bytes, or absolute paths before passing them to MultiAgentMonitor or MultiAgentLedger; alternatively, normalize the constructed path and verify it resolves under base_path using os.path.realpath comparison (trade-off: requires a code patch and may break agents using slashes in IDs intentionally). For multi-tenant ledger isolation, prepend a tenant- or session-scoped prefix to agent IDs so collisions cannot leak context (trade-off: existing IDs must be migrated). Run the PraisonAI process under a least-privileged OS user with no write access outside its data directory to limit blast radius if exploitation succeeds.