PraisonAI’s template loader permits GitHub template URIs with refs to be processed without normalizing path segments. The resolver stores the user‑controlled template path and ref verbatim and then concatenates them into a cache directory without verifying that the resulting path remains under the cache root. A crafted ref containing multiple "../" components allows the path to escape the intended cache directory, enabling the first load to create a .cache_meta.json file outside the cache and subsequent loads to invoke directory removal on an attacker‑selected path before reinstating the cache metadata. This flaw allows an attacker to write arbitrary files and delete arbitrary directories while the application is running. The issue has been resolved in version 4.6.59.

PraisonAI versions 2.6.0 through 4.6.58 inclusive, distributed by MervinPraison. The vulnerability requires that the application load templates from GitHub using refs; it does not affect other product lines or versions. Systems running the flushed framework with default template loading enabled are susceptible.

The CVSS score of 8.1 classifies this flaw as high severity. Although the EPSS score is not available and it is not listed in CISA’s KEV catalog, the exploit requires the ability to trigger a template load within PraisonAI, which could arise from local user activity or from a remote web service that uses the framework. The resulting impact includes arbitrary file write, directory deletion, data loss, disruption of service, and potential privilege escalation if critical system paths are targeted. The threat is therefore significant and warrants immediate action.