Description
PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() calls os.path.normpath() first, which collapses .. sequences, then checks for '..' in normalized. Since .. is already collapsed, the check always passes. This makes the check completely useless and allows trivial path traversal to any file on the system. This vulnerability is fixed in 1.5.113.
Published: 2026-04-07
Score: 9.2 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-693f-pf34-72c5 PraisonAI Has Path Traversal in FileTools
History

Tue, 07 Apr 2026 18:00:00 +0000

Type Values Removed Values Added
Description PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() calls os.path.normpath() first, which collapses .. sequences, then checks for '..' in normalized. Since .. is already collapsed, the check always passes. This makes the check completely useless and allows trivial path traversal to any file on the system. This vulnerability is fixed in 1.5.113.
Title PraisonAI has a Path Traversal in FileTools
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-04-07T16:46:15.192Z

Reserved: 2026-04-03T21:25:12.163Z

Link: CVE-2026-35615

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-07T17:16:35.980

Modified: 2026-04-07T17:16:35.980

Link: CVE-2026-35615

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses