PT-2026-81329

CVE-2026-55540

Published

2026-08-25

Updated

2026-09-10

Description by

CVSS 3.1

7.1

High

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58

Description PraisonAI contains path traversal flaws in its praisonai.code tool wrappers, which are intended to treat the workspace setting as a security boundary. The boundary is enforced inconsistently and unsoundly across several tools:

The is path within directory() function uses os.path.abspath() instead of os.path.realpath(). This allows a symlink located inside the workspace that points to a target outside the workspace to bypass security checks, enabling the read file, write file, apply diff, and search replace tools to access external files.
The list files() function fails to call the containment helper entirely, allowing absolute paths or ../ sequences to escape the workspace.
The execute command() and code execute command() functions do not validate the cwd (current working directory) parameter, allowing commands to be executed from directories outside the configured workspace.

An attacker capable of influencing an agent—via untrusted prompts or indirect prompt injection—can read, overwrite, list, and execute files and binaries outside the workspace, limited only by the filesystem permissions of the process user.

Recommendations Update PraisonAI to version 4.6.58. As a temporary mitigation, restrict the use of the read file, write file, apply diff, search replace, list files, and execute command tools when processing untrusted input.

Exploitability

Exploit

Fix

Impacts

Researchers

Riodrwn

Vendors

Affected products

Weakness enumeration

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2026-55540