praisonaiagents EUVD-2026-65520

Exploitation requires that the attacker control or influence the user_id argument passed to the FileMemory constructor or to the Agent constructor's memory configuration. In a single-user local deployment where user_id is hardcoded, exploitation is not possible without pre-existing local access. In a multi-tenant or API-facing deployment where user_id is derived from user-supplied input (e.g., a session identifier, username, or API parameter), any authenticated API caller can exploit the flaw without further privileges. The exploit works on both Linux and Windows due to pathlib's cross-platform path resolution. No special non-default configuration is required - the FileMemory class is a standard library component. Limiting factors: PR:L means unauthenticated exploitation is not possible; S:U means the attack cannot directly escape the process privilege boundary to affect other systems beyond what the process account can write.

The NVD CVSS 7.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) characterizes this as network-reachable, low-complexity, low-privilege exploitation with high integrity impact. The PR:L rating is the key limiting factor: an attacker must already hold some level of authenticated access to invoke the FileMemory API or the Agent constructor that calls it. There is no confidentiality impact - the attack writes data, it does not read arbitrary files. The A:L score reflects the risk of overwriting existing files. No EPSS score was provided in the intelligence; no CISA KEV listing exists, confirming no known active exploitation. A detailed PoC is embedded in the GHSA advisory itself, significantly lowering the bar for exploitation by any authenticated caller. Real-world risk is contingent on deployment architecture: applications that accept user_id from untrusted network input (e.g., a multi-tenant API) face meaningful write-anywhere risk, whereas tightly controlled internal deployments face negligible exposure. The CVSS network vector is consistent with how the library would be consumed in a hosted agent service.

An attacker with low-privileged access to a multi-tenant application that exposes PraisonAI agent functionality sends a request with user_id set to '../../etc/cron.d/backdoor', causing praisonaiagents to create that directory path and write a JSON file there - potentially disrupting system integrity or, on permissive cron configurations, achieving code execution. A full PoC demonstrating the direct Python API path (FileMemory(user_id='../../etc/evil')) is publicly documented in GHSA-gxmw-5f7x-6g22, lowering the exploitation barrier for any authenticated API consumer.