TI-2026-79617 Aliases CVE-2026-57113

Path traversal in PraisonAI template cache allows outside file write

LOW 35CWE-22Published 2026-10-23 · Updated 2026-10-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

PraisonAI from 2.6.0 before 4.6.59, the praisonai package on PyPI, has a path traversal flaw (CWE-22) in its GitHub template cache. The cache joins user-supplied template paths and refs into file paths without checking that they stay inside the cache directory. A remote attacker who gets a user to load a crafted GitHub template URI can write a file outside the cache and delete an attacker-selected outside directory.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00405 34th percentileScored 2026-11-07

Fix Fixed PraisonAI (MervinPraison): 4.6.59praisonai (PyPI): 4.6.59

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MervinPraison	PraisonAI	2.6.0 to before 4.6.59	4.6.59	Patch available	CNA
—	praisonai (PyPI)	2.6.0 to before 4.6.59	4.6.59	Patch available	GHSA-f44v-7qgw-9gh9

PraisonAI VendorMervinPraison Affected 2.6.0 to before 4.6.59 Fixed in 4.6.59 Patch available CNA
praisonai (PyPI) Vendor— Affected 2.6.0 to before 4.6.59 Fixed in 4.6.59 Patch available GHSA-f44v-7qgw-9gh9

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:praison:praisonai::::::::	—	—	MervinPraison

cpe:2.3:a:praison:praisonai:*:*:*:*:*:*:*:* Versions — — ·MervinPraison

Remediation

Upgrade the PyPI package praisonai to version 4.6.59, which fixes this issue. The sources list no fixed version for PraisonAI.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA PraisonAI (MervinPraison) Fixed in 4.6.59
Fix · GHSA-f44v-7qgw-9gh9 praisonai (PyPI) Fixed in 4.6.59 Advisory →

Timeline

2026-10-23 Threatist record created from CVE-2026-57113
2026-10-23 CISA SSVC decision points changed
2026-10-23 Priority changed: MEDIUM → LOW

References

Other 2

TI-2026-79619 Missing authentication in PraisonAI AgentOS exposes agent chat CVSS 3.1CRITICAL 9.8
TI-2026-71236 Missing access control in PraisonAI AgentTeam exposes agent endpoints CVSS 3.1CRITICAL 9.8
TI-2026-44052 PraisonAI before 1.6.78 Remote Code Execution via CodeAgent CVSS 4.0CRITICAL 10.0
TI-2026-41123 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) CVSS 3.1CRITICAL 9.8
TI-2026-41122 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery CVSS 3.1CRITICAL 9.8
TI-2026-41118 PraisonAI MCPServer exposes unauthenticated HTTP tools/call CVSS 3.1CRITICAL 9.8

See all 177 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences