CVE-2026-55527

Name of the Vulnerable Software and Affected Versions praisonaiagents versions prior to 1.6.58

Description An arbitrary file write issue exists due to improper sanitization of the user id parameter in the FileMemory. init () function. When the FileMemory constructor joins the user id into self.user path without validation, a caller can provide path separators or ../ sequences to escape the intended memory directory. This allows an attacker to write JSON data to any location on the filesystem that the process has permission to write to. This can be exploited via the direct Python API, the Agent constructor, or through agents.yaml and job submissions.

Recommendations Update praisonaiagents to version 1.6.58 or later. As a temporary workaround, restrict the use of the user id parameter to only allow alphanumeric characters, hyphens, underscores, and dots.