The vulnerability lies in the _safe_extractall helper used by PraisonAI's recipe pull, publish, and unpack flows. It validates archive member names for absolute paths and '..' segments, but ignores the linkname field and does not reject symlink or hardlink members. The helper calls tar.extractall(dest_dir) without a data filter, allowing a crafted bundle that contains a symlink pointing outside the intended extraction directory. A subsequent regular file that follows that symlink during extraction can write data to an attacker‑chosen location outside dest_dir. This flaw effectively permits an attacker to write arbitrary files to the filesystem. The weakness is a form of path traversal (CWE‑22) and absolute path traversal (CWE‑59).

The vulnerable versions of PraisonAI (4.6.36 and earlier) from vendor MervinPraison are affected. The fix is available in version 4.6.37. All users running any of these affected versions should plan an upgrade to the patched release. No other vendors or products are listed as affected.

The CVSS score of 8.7 indicates a severe vulnerability. EPSS is not available, and the issue is not listed in CISA's KEV catalog, but the potential impact remains high. It is inferred that the attacker must supply a malicious tar archive to a user or process that initiates extraction. As the extraction runs under the privileges of the PraisonAI service, an attacker can potentially write files to critical system locations. Therefore, the risk level is high, especially in environments where PraisonAI runs with elevated privileges or processes untrusted bundles.