Vulnerability details

CVE-2026-55540

MervinPraison PraisonAI

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

CVSS 3.1

7.1High

Official description

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing read_file and other code tools to access files outside the configured workspace. This issue is fixed in version 4.6.58.

CVSS scores

Score	Version	Source	Vector
7.1High	3.1	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L`

Affected products

Vendor	Product	Versions	Source
MervinPraison	PraisonAI	< 4.6.58	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1 x_refsource_MISC
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.58 x_refsource_MISC
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ch89-h4r2-c8f8 x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-08-25
Last updated: 2026-08-27
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.39%

Probability of exploitation in 30 days

33.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')