Executive brief
PraisonAIAgents is a framework for building AI-driven agents. A security flaw in its file-listing tool allows an attacker to bypass intended security boundaries and view information about files anywhere on the server's hard drive. While the contents of the files are not directly exposed, an attacker can discover sensitive file names, sizes, and system structures, which can be used to plan more advanced attacks.
Technical details
A path traversal vulnerability exists in the `list_files()` function within `FileTools`. While the `directory` parameter is validated, the `pattern` parameter is passed unvalidated to Python's `Path.glob()`, which supports `..` segments. An attacker can exploit this by providing a malicious glob pattern (e.g., `../../../etc/*`) to traverse outside the workspace boundary. This allows for the enumeration of arbitrary files and the retrieval of metadata including file names, sizes, and timestamps. The vulnerability is accessible to any user capable of influencing the LLM agent's tool calls, such as through direct prompting or prompt injection. The issue is addressed in version 1.5.128.
Affected products
- MervinPraison praisonaiagents < 1.5.128
Timeline
- 2026-04-09: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in version 1.5.128