Home

Description

PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.

PUBLISHED Reserved 2026-07-09 | Published 2026-07-10 | Updated 2026-07-10 | Assigner VulnCheck




MEDIUM: 6.8CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
MEDIUM: 5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Problem types

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status
unaffected

Any version before 4.6.78
affected

4.6.78 (semver)
unaffected

Credits

rexpository reporter

References

github.com/...isonAI/security/advisories/GHSA-q7m5-3jmv-vm48 exploit

github.com/...isonAI/security/advisories/GHSA-q7m5-3jmv-vm48 (GitHub Security Advisory (GHSA-q7m5-3jmv-vm48)) vendor-advisory

github.com/...ommit/1620b49f36945d8cc8ee5635b906c960df5097a0 patch

www.vulncheck.com/...fore-path-traversal-via-contextgatherer (VulnCheck Advisory: PraisonAI before 4.6.78 Path Traversal via ContextGatherer) third-party-advisory

cve.org (CVE-2026-61431)

nvd.nist.gov (CVE-2026-61431)

Download JSON