PT-2026-57192 · Mervinpraison · Praisonai

Rexpository · Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-61432

NVD

CVSS v3.1

5.7

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

PraisonAI (praisonaiagents) before 1.6.78 contains a path traversal vulnerability in the FastContext feature (praisonaiagents.context.fast). FastContextAgent.execute tool() prepends the configured workspace path only for relative paths and neither rejects absolute paths nor canonicalizes joined paths before enforcing workspace containment. As a result, tool arguments or model-generated function calls to grep search, glob search, read file, or list directory can supply absolute paths or '../' traversal sequences to read, search, and enumerate files outside the intended workspace directory, with file contents returned to the caller or injected into the model's tool-result context.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-61432

Produtos afetados

Praisonai

Referências · 4

• 🔥 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4xxv-6wmf-xf45 · Exploit
• https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-61432 · Nota de Segurança
• https://vulncheck.com/advisories/praisonai-fastcontext-before-path-traversal · Nota