EUVD-2026-42897
GHSA-w37c-cq55-frjp
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with required user interaction to process workspace files; no integrity or availability impact, only high confidentiality loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.
AnalysisAI
Path traversal in PraisonAI's ContextGatherer component (all versions before 4.6.78) allows an attacker who can supply or manipulate .praisoncontext or .praisoninclude files to read arbitrary files outside the intended workspace directory, including sensitive system files accessible to the user running PraisonAI. The vulnerability stems from a complete absence of path validation before file inclusion, permitting both absolute paths and relative traversal sequences. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis; however, the attack is conceptually simple and requires no special tooling once an attacker can influence project workspace files.
Technical ContextAI
PraisonAI (CPE: cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*) is a Python-based AI agent orchestration framework. Its ContextGatherer component reads .praisoncontext and .praisoninclude configuration files to assemble a context bundle passed to the AI model. CWE-22 (Path Traversal) identifies the root cause: the component fails to canonicalize or restrict file paths supplied in these config files before opening them on the local filesystem. Without checks such as resolving symlinks and confirming the resolved path remains within the workspace root, attackers can supply sequences like ../../../../etc/passwd or absolute paths like /etc/shadow to escape the workspace boundary. The resulting file contents are silently incorporated into the context bundle, potentially leaking sensitive material to whoever receives or logs that bundle.
RemediationAI
Upgrade PraisonAI to version 4.6.78 or later; this is the vendor-confirmed fix version per the CVE description. The upstream code change is available at commit 1620b49f36945d8cc8ee5635b906c960df5097a0 (https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0) and the full advisory is at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q7m5-3jmv-vm48. As a compensating control prior to patching, avoid running PraisonAI's context gathering against untrusted or externally sourced project directories; in CI/CD pipelines, restrict which repositories are permitted to supply .praisoncontext and .praisoninclude files and audit any such files before execution. Note that restricting CI pipeline inputs introduces workflow friction and does not address the root cause.
We need answer JSON only. Need obey. Need analyze CVE. Need synthesize all data. Need not copy description. Need include
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today