PraisonAI’s Dynamic Context module concatenates user-controlled run_id and agent_id values into filesystem paths without sanitization. This allows an attacker who can invoke the exposed tool factories to read files outside the intended storage directory, including sensitive .jsonl and .log files. The compromise leads to information disclosure and potential further exploitation once trusted data is accessed.

The vulnerability exists in PraisonAI versions 3.8.1 through 4.6.58. The fix is available in version 4.6.59 and later.

The CVSS score of 7.5 indicates a moderate-to-high risk. No EPSS data are provided, and the vulnerability is not listed in CISA KEV, suggesting it may not be actively exploited yet. An attacker can achieve local file read via the tool interface if they can supply crafted run_id or agent_id values, which is likely through a lower-trust prompt or user input. The path‑traversal flaw enables read access beyond the configured base directory, providing access to potentially privileged data.