PraisonAI's Model Context Protocol (MCP) server registers several file‑handling tools that assemble user‑supplied filenames into a path under the application's rules directory without validating containment. This oversight allows an attacker to traverse outside the intended directory using a crafted rule name such as `../../etc/shadow`, thereby creating or overwriting any file the running user can write. If the attacker then drops a Python `.pth` file into the user’s site‑packages directory, the Python interpreter will load it on the next run, resulting in arbitrary code execution under the user’s privileges.

The vulnerable implementation exists in all releases of PraisonAI older than version 4.6.34. The software is distributed by MervinPraison under the product name PraisonAI, a multi‑agent teams system. Clients that expose the MCP server to potentially malicious callers, or that operate under an account with broad filesystem permissions, are susceptible. No specific version numbering beyond the pre‑4.6.34 threshold is listed, so any prerelease lacking the patch is impacted.

The CVSS score of 9.4 classifies this flaw as critical, and while no EPSS value is currently available, the lack of containment and the ability to drop a Python `.pth` file suggest a high exploitation probability in environments where the MCP server is reachable. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation provides remote attackers with full code execution that can affect data confidentiality, integrity, and availability for any process spawned by the affected user.