PraisonAI automatically loads defaults from a project‑local .praisonai/config.toml when an Agent is constructed and does not validate the defaults.output.output_file setting. If that setting contains an absolute path or a ".." traversal sequence, and the developer later calls agent.start() without providing an explicit output parameter, PraisonAI writes the agent response to that location, creating any parent directories. This permits a repository‑controlled configuration file to overwrite files outside the project root with the privileges of the user running PraisonAI, an issue that maps to CWE‑22.

The affected products are MervinPraison PraisonAI, specifically the Python package praisonaiagents. All installations of PraisonAI with pip versions earlier than 1.6.78 that load a .praisonai/config.toml file from a project root are vulnerable. No additional version details are provided beyond the upper bound of 1.6.78.

The CVSS score of 6.9 indicates moderate severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, implying a low likelihood of widespread exploitation at present. Exploitation requires the attacker to supply or modify a repository‑controlled config file, which is feasible in environments that accept code from external contributors. Successful exploitation results in arbitrary file overwriting and the potential for further compromise or denial of service.