Description

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files accessible to the service account, exposing credentials, keys, environment variables, and other local data. This vulnerability is fixed in 4.6.59.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T16:17:13.130Z",
  "pubdate": "2026-09-14T16:17:13.130Z",
  "executiveSummary": "PraisonAI versions prior to 4.6.59 are susceptible to an unauthenticated arbitrary file read vulnerability via the Jobs API.\nThe vulnerability stems from improper input validation in the POST /api/v1/runs endpoint, where the 'agent_file' parameter fails to restrict file access to the intended workspace directory.\nA remote, unauthenticated attacker can exploit this flaw to perform directory traversal and absolute path injection, effectively gaining unauthorized access to sensitive files residing on the host system.\nSuccessful exploitation allows for the exfiltration of critical system data, including service account credentials, cryptographic keys, and environment variables.\nThe risk implication is severe, as it facilitates full system information disclosure and potential lateral movement or privilege escalation depending on the service account's existing OS-level permissions.\nExploitation requires no prior authentication, significantly lowering the barrier for entry for malicious actors targeting deployments of the PraisonAI multi-agent framework.",
  "technicalDetails": "The vulnerability is located within the Jobs API component of the PraisonAI framework, specifically affecting the processing logic of the POST /api/v1/runs endpoint.\nThe root cause is a failure to implement a workspace allowlist or perform boundary validation on the 'agent_file' input parameter before passing it to the underlying job executor.\nIn the affected versions, the application logic directly accepts user-supplied input for 'agent_file', which may contain path traversal sequences (e.g., '../') or absolute system paths (e.g., '/etc/passwd').\nBecause the system lacks a chroot-like environment or a strict path validation mechanism, the job executor follows the provided path and opens the specified file with the privileges of the service account running the PraisonAI process.\nThe attack flow follows a direct exploitation pattern: 1) The attacker sends a crafted POST request to /api/v1/runs. 2) The attacker embeds a malicious payload within the 'agent_file' parameter (e.g., /proc/self/environ or /home/user/.ssh/id_rsa). 3) The backend executor attempts to initialize the agent using the provided file path. 4) The service process reads the target file and exposes its contents back to the attacker or utilizes the content in a way that leads to disclosure.\nThis behavior bypasses intended application boundaries, allowing an attacker to navigate outside the project workspace and interact with sensitive configuration files, local credentials, and environment-specific keys that the service account has read access to.\nSince the endpoint is exposed without authentication, the vulnerability is remotely exploitable and reachable over the network where the PraisonAI API is listening.\nPost-exploitation impact includes the full exposure of secrets needed to impersonate the service account, unauthorized access to cloud provider metadata if the service resides in a cloud environment, and the compromise of system-level configuration parameters, which may serve as a precursor to further system-wide exploitation."
}