The Action Orchestrator feature in PraisonAI versions prior to 1.5.113 allows a path traversal flaw that enables an attacker or a compromised internal agent to write files outside of the configured workspace directory. By supplying relative path segments such as "../" in the target path, the orchestrator can overwrite critical system files or place executable payloads on the host, potentially compromising the entire system.

Vendors: MervinPraison. Product: PraisonAI multi‑agent teams system. All releases before version 1.5.113 are affected. The issue is fixed in 1.5.113.

The CVSS score of 9 indicates critical severity. EPSS data is unavailable, but the vulnerability is nonetheless significant. The likely attack vector is an attacker (or a compromised agent) invoking the Action Orchestrator with a crafted path to trigger the arbitrary write. The flaw is not listed in CISA's KEV catalog; however, any user able to access the orchestrator, whether remotely or locally, could potentially exploit it to modify system files or install malware.