PraisonAI’s recipe registry publish endpoint processes a bundle’s internal manifest.json and creates files based on the path derived from that manifest before the server verifies that the manifest name and version match the HTTP route. A malicious publisher can embed directory traversal sequences, such as \'../\', in the manifest so the registry attempts to write files outside its configured root directory. Even though the request ultimately generates a 400 response, the write operation occurs. This results in an arbitrary file write that can overwrite critical system files or place malicious content on the server, potentially leading to privilege escalation or code execution.

The vulnerability affects MervinPraison’s PraisonAI product in all releases prior to version 1.5.113. Any installation that exposes the recipe registry publish flow, whether publicly accessible or protected by a token, is susceptible. If the registry runs without authentication, any network client can trigger the flaw; if authentication is enabled, any user with publish permissions can exploit it.

The CVSS score of 7.1 indicates moderate to high severity, and although EPSS data is unavailable, the path‑traversal nature and network trigger suggest a relatively high likelihood of exploitation, especially on services that are openly exposed. Because the vulnerability is not listed in the CISA KEV catalog, there is no confirmed exploitation in the wild, but the threat remains significant for exposed deployments.