PT-2026-30763 · Praisonai · Praisonai

Kritsana-Chaikaew · Published 2026-04-06 · Updated 2026-04-08 · CVE-2026-35615

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 1.5.113

Description PraisonAI is susceptible to a path traversal issue due to a flaw in the validate path() function. This function first calls os.path.normpath(), which collapses '..' sequences, and then checks for the presence of '..' in the normalized path. Because the '..' sequences are collapsed before the check, the check is ineffective, allowing an attacker to traverse to any file on the system. The vulnerability also exists because the path validation function does not resolve symbolic links, which could potentially cause path traversal. The vulnerable file is src/praisonai-agents/praisonaiagents/tools/file tools.py lines 42-49. This allows access to any file on the system, potentially including sensitive files like /etc/passwd and /etc/shadow.

Recommendations Update PraisonAI to version 1.5.113 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-35615

GHSA-693F-PF34-72C5

Affected Products

Praisonai

References · 8

• 🔥 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-693f-pf34-72c5 · Exploit
• https://osv.dev/vulnerability/GHSA-693f-pf34-72c5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35615 · Security Note
• https://github.com/MervinPraison/PraisonAI · Note
• https://github.com/MervinPraison/PraisonAI/releases/tag/v4.5.113 · Note
• https://reddit.com/r/VulnMatter/comments/1sexrsn/resumen_diario_de_vulnerabilidades_07042026 · Reddit Post
• https://twitter.com/pulsepatchio/status/2041710750729957854 · Twitter Post
• https://twitter.com/CVEnew/status/2041569977304805834 · Twitter Post