Description

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-14T15:17:06.317Z",
  "pubdate": "2026-09-14T15:17:06.317Z",
  "executiveSummary": "PraisonAI versions prior to 1.6.59 are susceptible to an arbitrary file read vulnerability originating from insecure handling of file-mention inputs.\nThe vulnerability resides within the MentionsParser._process_file_mention function, which fails to enforce boundary validation or sanitize user-supplied file paths.\nAn attacker can exploit this flaw by injecting malicious file paths via prompts or workflows, allowing unauthorized access to sensitive information such as environment variables, private keys, system configurations, and proprietary source code.\nThe impact of successful exploitation is significant, as it grants attackers the ability to exfiltrate confidential data accessible to the service process context.\nThere are no complex requirements for exploitation; the vulnerability is triggered by providing crafted input that the system processes without adequate security constraints.\nThe issue is classified as an improper restriction of file path access, fundamentally compromising the integrity of the application's file access controls.",
  "technicalDetails": "The vulnerability is located in the MentionsParser._process_file_mention function within the praisonaiagents package. The root cause is the lack of proper input validation when processing file-mention identifiers.\nWhen a user or automated agent provides a file-mention string, the system initially attempts to resolve the path relative to the defined workspace. However, the logic contains an insecure fallback mechanism that utilizes Python's Path(file_path) constructor directly if the workspace-relative resolution fails.\nCrucially, the implementation fails to verify if the resolved path resides within the intended workspace boundary. Furthermore, the system does not implement checks against symbolic link traversal or directory traversal sequences (e.g., '../'), allowing attackers to escape the application's root directory.\nThe attack flow begins when an attacker supplies a malicious prompt or workflow input containing an absolute file path or a path utilizing traversal sequences to point to a sensitive system file (e.g., /etc/passwd, .env, or SSH private keys).\nUpon receiving this input, MentionsParser._process_file_mention proceeds to process the string. Since the validation logic lacks path sanitization, the application reads the file contents from the target path as if it were a legitimate workspace file.\nBecause the agent process typically runs with the permissions of the service user, the attacker inherits those privileges, granting them read access to any file on the underlying filesystem that the service user is authorized to read.\nThis vulnerability is present in all versions of praisonaiagents prior to 1.6.59. It does not require specialized authentication beyond the ability to interact with the agent's input interface. The exploit does not require interaction with the network if the attacker has local prompt access, though it is highly exposed in multi-user or agentic orchestration environments where prompts are externally sourced.\nPost-exploitation, the impact involves the complete compromise of credentials, environment secrets, and intellectual property. The ability to read system-wide configuration files may also facilitate secondary exploitation or lateral movement within the environment where PraisonAI is deployed."
}