Description

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks. Prompt-influenced agents can read files through edit and diff behavior or overwrite files accessible to the process, exposing secrets and enabling persistence or application tampering. This issue is fixed in 4.6.62.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-14T16:17:15.017Z",
  "pubdate": "2026-09-14T16:17:15.017Z",
  "executiveSummary": "PraisonAI versions prior to 4.6.62 contain a critical path traversal vulnerability within the multiedit.py module. The flaw stems from the application's failure to sanitize or validate user-controlled file path inputs before performing file system operations.\nBy leveraging an LLM-controlled agent, an attacker can manipulate file path parameters to bypass intended workspace boundaries, allowing for arbitrary file read and write operations. This enables the unauthorized extraction of sensitive information, such as environment variables, configuration files, or source code.\nFurthermore, the ability to overwrite arbitrary files provides a vector for persistent code injection, leading to potential full system compromise or application tampering. This vulnerability is particularly severe because the agent's interaction model facilitates the automated execution of malicious file operations without explicit user intervention, significantly lowering the barrier for exploitation. The risk is high, necessitating an immediate upgrade to version 4.6.62 or later to enforce proper path resolution and security constraints.",
  "technicalDetails": "The vulnerability resides in the src/praisonai/praisonai/tools/multiedit.py component of PraisonAI, specifically within the functions responsible for managing file editing and diff operations. The root cause is the direct pass-through of LLM-supplied path parameters to native Python file system interfaces, such as the open() function, without prior sanitization, traversal validation, or boundary checking.\nThe application lacks mechanisms to resolve symbolic links (symlinks) or verify that the requested file path remains within a predefined, secure workspace directory. Consequently, the system is susceptible to directory traversal attacks where an attacker can supply sequences such as '../' to escape the intended directory scope.\nThe exploitation flow proceeds as follows: 1) An attacker provides a crafted prompt to the PraisonAI agent, which the LLM interprets as an instruction to perform an edit or read operation on a sensitive target file located outside the designated workspace. 2) The multiedit.py component receives the malicious path string directly from the agent's logic. 3) Because there is no check for directory traversal, the underlying operating system executes the file operation (read/write) at the attacker-specified path with the effective privileges of the PraisonAI process. 4) If the operation is a read, the content of the target file is returned to the agent and subsequently exposed to the user. If the operation is a write, the contents of the target file are overwritten with the agent's output.\nThis vulnerability effectively elevates the agent's capabilities from restricted workspace interaction to arbitrary file system access. An attacker can exploit this to leak environment secrets, modify source code to introduce backdoors, or tamper with system binaries if the process runs with sufficient privileges. Since the agent interprets the path dynamically, no specific authentication or complex network-level exploitation is required beyond interaction with the agent-based system itself. The lack of protected-path checks means that even system-critical files are vulnerable to modification, leading to significant post-exploitation impact including, but not limited to, remote code execution or complete service disruption."
}