PraisonAI allows creation of symlinks within its configured workspace that circumvent the intended boundary check. The is_path_within_directory function uses os.path.abspath rather than os.path.realpath, so a symlink that points outside the workspace still passes verification. As a result, the read_file and other code tools can fetch data from files located beyond the workspace, exposing confidential information or system configuration files. This flaw is a path traversal vulnerability, identified as CWE‑22, and is fixed in version 4.6.58.

MervinPraison's PraisonAI using the application prior to version 4.6.58 is susceptible. Versions up to and including 4.6.57 retain the vulnerable path check. The fix was included in the 4.6.58 release.

The CVSS score of 7.1 denotes a high risk attack, and no exploitation probability is available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to create a symlink inside the workspace which can be achieved by a local user or an adversary who can influence agent tool input. Once a malicious symlink is in place, read_file operations can retrieve arbitrary files outside the intended directory. While the flaw affects confidentiality primarily, it can also allow privilege escalation if the accessed files contain credentials or configuration.