PraisonAI’s FileTools.download_file() validates the file path but not the URL argument, passing it directly to httpx.stream() with redirects enabled. This flaw permits an attacker that can specify the URL to trigger outbound HTTP(S) requests from the PraisonAI server to any host reachable from that environment, including cloud metadata endpoints and internal network services. The resulting information disclosure or remote code execution depends on the target service’s exposure and could compromise confidentiality and potentially integrity of internal resources.

The vulnerability affects the MervinPraison PraisonAI product, specifically the praisonaiagents component in all releases before 1.5.95. Users running any older version are susceptible; the issue is safely resolved in version 1.5.95 and later.

With a CVSS base score of 8.6, the flaw is high severity. The EPSS score of less than 1 % suggests a low probability of near‑future exploitation, and it is not listed in the CISA KEV catalog. The likely attack vector requires an adversary to supply a crafted URL to FileTools.download_file(); if the function is exposed via an API or internal workflow, the server can be compelled to contact arbitrary endpoints, including sensitive metadata services. Exploitation is straightforward, relying only on the ability to control the URL parameter and the server’s outbound network reachability.