PraisonAI FastContext before version 1.6.78 contains a path traversal flaw that occurs when the execute_tool operation prepends the configured workspace path only for relative paths and does not reject absolute paths or canonicalize joined paths before verifying workspace containment. As a result, tool arguments or model-generated function calls to GREP_SEARCH, GLOB_SEARCH, READ_FILE, or LIST_DIRECTORY can supply absolute enabling an attacker to read, search, and list files outside the intended workspace directory. The data from the remote file is then returned to the caller or injected into the model’s tool‑result context, giving the view of the file system. This weakness is a classic example of CWE‑22, whereby an attacker may compromise confidentiality of local files within the application environment.

The affected product is MervinPraison PraionAI, specifically the PraisonAI FastContext feature within the praisonaiagents package. Versions prior to 1.6.78 are impacted; the vulnerability is later releases.

The vulnerability has a CVSS score of 6.9, indicating moderate severity. The EPSS score of <1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, as an attacker could trigger the flaw by supplying crafted tool arguments or model‑generated function calls via an exposed API or external model communication interface. If the environment grants the application sufficient privileges, reads of sensitive files could provide valuable information or aid further exploitation.