PT-2026-31791 · Unknown · Praisonaiagents

Published 2026-04-09 · Updated 2026-04-10 · CVE-2026-40152

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PraisonAIAgents versions prior to 1.5.128

Description PraisonAIAgents is a multi-agent teams system. The list files() tool in FileTools validates the directory parameter against workspace boundaries using the validate path() function, but passes the pattern parameter directly to Path.glob() without validation. Python's Path.glob() function supports '..' path segments, allowing an attacker to use relative path traversal in the glob pattern to enumerate arbitrary files outside the workspace. This can expose file metadata, including existence, name, size, and timestamps, for any path on the filesystem.

Recommendations Update to version 1.5.128 or later.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-40152

GHSA-7J2F-XC8P-FJMQ

Affected Products

Praisonaiagents

References · 6

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7j2f-xc8p-fjmq · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7j2f-xc8p-fjmq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40152 · Security Note
• https://github.com/MervinPraison/PraisonAI · Note
• https://twitter.com/VulmonFeeds/status/2042405612512809440 · Twitter Post
• https://twitter.com/CVEnew/status/2042561826240766208 · Twitter Post