PT-2026-61767 · Praisonai · Praisonai
CVE-2026-57113
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PraisonAI versions 2.6.0 through 4.6.57
Description
The template loader fails to properly normalize or validate GitHub template URIs, allowing the
path and ref variables to be stored verbatim. This leads to a path traversal issue where a crafted ref can escape the template cache root directory. An attacker can exploit this to create a .cache meta.json file in arbitrary locations or delete directories reachable by the process via the shutil.rmtree() function in the put() method of the TemplateCache class. This can result in the corruption of user configurations, project state, or application data. The issue occurs because the get cache path() function in praisonai/templates/cache.py constructs the filesystem path without verifying that the final resolved path remains within the intended cache directory.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Restrict the use of GitHub template URIs from untrusted sources to minimize the risk of exploitation.
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai