A path traversal flaw in the recipe registry pull flow of PraisonAI allows an attacker to upload a tar archive containing "../" entries. When a user later pulls that recipe, the client extracts the archive without validating member paths, writing files outside the chosen output directory and potentially overwriting critical files. Because the malicious entries are part of the signed bundle, checksum verification does not prevent the attack. This results in an arbitrary file write on the client machine.

The vulnerability affects the PraisonAI multi‑agent teams system from the vendor MervinPraison. It is present in all releases prior to version 1.5.113 and impacts both local registry pulls and HTTP registry pulls.

The CVSS score of 7.3 denotes a high severity issue. While no EPSS score is provided and the flaw is not listed in the KEV catalog, the attack vector requires a malicious publisher to supply a crafted recipe bundle and a victim to pull that bundle. An affected user can therefore write files at arbitrary paths, exposing the system to potential privilege escalation or persistence, and the vulnerability is exploitable from the client side.