# CVE-2026-40152: MervinPraison PraisonAIAgents path traversal in list_files tool

Source: https://junglewise.ai/threats/cve-2026-40152-mervinpraison-praisonaiagents-path-traversal-in-list-files-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-09. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40152 · Severity: medium · CVSS 5.3 · Published 2026-04-09

PraisonAIAgents is a framework for building AI-driven agents. A security flaw in its file-listing tool allows an attacker to bypass intended security boundaries and view information about files anywhere on the server's hard drive. While the contents of the files are not directly exposed, an attacker can discover sensitive file names, sizes, and system structures, which can be used to plan more advanced attacks.

Technologies: [MervinPraison PraisonAI Agents](https://junglewise.ai/threats/technologies/praisonai-agents), [Praisonaiagents](https://junglewise.ai/threats/technologies/praisonaiagents), [praisonaiagents (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonaiagents). Vendors: [MervinPraison](https://junglewise.ai/threats/vendors/mervinpraison), [Praison](https://junglewise.ai/threats/vendors/praison), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-40152 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40152 being exploited in the wild.

**How severe is CVE-2026-40152?** Medium severity, with a CVSS score of 5.3, published 9 April 2026.

**Which products and versions are affected?** praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.128.

**Is there a fix for CVE-2026-40152?** Yes. praisonaiagents (PyPI): upgrade to 1.5.128 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40152 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40152?** Check whether you run MervinPraison PraisonAI Agents, Praisonaiagents or praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonaiagents (PyPI): upgrade to 1.5.128 or later

  ```sh
  pip install "praisonaiagents>=1.5.128"
  ```


## Technical details

A path traversal vulnerability exists in the `list_files()` function within `FileTools`. While the `directory` parameter is validated, the `pattern` parameter is passed unvalidated to Python's `Path.glob()`, which supports `..` segments. An attacker can exploit this by providing a malicious glob pattern (e.g., `../../../etc/*`) to traverse outside the workspace boundary. This allows for the enumeration of arbitrary files and the retrieval of metadata including file names, sizes, and timestamps. The vulnerability is accessible to any user capable of influencing the LLM agent's tool calls, such as through direct prompting or prompt injection. The issue is addressed in version 1.5.128.

## Affected products

- MervinPraison praisonaiagents < 1.5.128

## Identifiers

- CVE-2026-40152
- GHSA-7j2f-xc8p-fjmq
- PYSEC-2026-2944

## Timeline

- 2026-04-09: disclosed
- 2026-04-10: advisory
- 2026-04-10: patched: Fixed in version 1.5.128

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [PraisonAI SearxNG URL validation bypass in search tools](https://junglewise.ai/threats/cve-2026-57143-praisonai-server-side-request-forgery-ssrf-in-searxng-search-web)
- [PraisonAI missing access control in API endpoints](https://junglewise.ai/threats/cve-2026-57118-praisonai-agentteam-launch-exposes-unauthenticated-remote-agent)
- [PraisonAI legacy SSE endpoint CORS and authentication bypass](https://junglewise.ai/threats/cve-2026-57112-praisonai-legacy-sse-endpoint-cors-and-authentication-bypass)
- [PraisonAI IMAP injection in email tools](https://junglewise.ai/threats/cve-2026-57130-praisonai-imap-injection-in-email-tools)
- [PraisonAI path traversal in file mention parsing](https://junglewise.ai/threats/cve-2026-57129-praisonai-path-traversal-in-file-mention-parsing)