Is there a patch available for EUVD-2026-43174?

Yes, a patch is available for EUVD-2026-43174. Update the affected software to the latest version immediately.

PraisonAI EUVD-2026-43174

Q: What is the CVSS score of EUVD-2026-43174?

EUVD-2026-43174 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-60088 MEDIUM

Path Traversal (CWE-22)

2026-07-11 VulnCheck

GHSA-wgvq-3jxh-4qg7

Path Traversal Praisonai Mervinpraison

6.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Local vector (AV:L) and required user interaction (UI:R) because the victim must load the crafted command file; attacker needs no privileges on the target system.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 14:13 vuln.today

DescriptionCVE.org

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path traversal sequences like @../outside_secret.txt or absolute paths in project command files to exfiltrate process-readable files into model prompts.

AnalysisAI

Path traversal in PraisonAI before 4.6.78 enables file exfiltration outside the workspace by embedding traversal sequences (e.g., @../outside_secret.txt) or absolute paths in custom project command templates, which are then injected verbatim into model prompts. Users who process attacker-controlled command files expose all process-readable files - including credentials, environment variables, and application secrets - to whoever controls the model interaction. No public exploit code has been identified and PraisonAI is not listed in the CISA KEV catalog at time of analysis; a vendor patch is available.

Technical ContextAI

PraisonAI is an open-source multi-agent AI orchestration framework (CPE: cpe:2.3:a:mervinpraison:praisonai:*:*:*:*:*:*:*:*) that allows users to define project-level command templates referencing local files via an @filename syntax. CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal) identifies the root cause: the template parser accepts user-supplied path references without canonicalizing or bounding them to the workspace directory. As a result, sequences like @../../../etc/shadow or absolute paths like /home/user/.ssh/id_rsa are resolved against the host filesystem at the process's permission level, and the resolved file contents are silently folded into the prompt context sent to the underlying model.

RemediationAI

Upgrade PraisonAI to version 4.6.78 or later, which incorporates the fix from commit 3aa9cbc2bd49c23a32be0a89a5e620d13d843eab (https://github.com/MervinPraison/PraisonAI/commit/3aa9cbc2bd49c23a32be0a89a5e620d13d843eab). The vendor advisory at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xpx6-x8c2-mw5w should be consulted for release guidance. As a compensating control before patching, restrict the OS-level file permissions of sensitive files (credentials, key material, .env files) so they are not readable by the user or service account running PraisonAI - note this reduces the blast radius but does not eliminate the path traversal flaw. Additionally, avoid processing project command files from untrusted or unreviewed sources; auditing command templates for @.. or absolute-path references can identify malicious files before execution.