Executive brief
PraisonAI Agents is a Python library for building multi-agent AI systems. The FileMemory component, which persists agent conversation history and state to JSON files on disk, fails to validate the user_id parameter before using it to construct filesystem paths. An attacker can supply path traversal sequences (e.g., `../../etc/evil`) to write JSON files to any writable location on the system, potentially overwriting application configs, cron jobs, or other critical files.
Technical details
The vulnerability exists in `praisonaiagents/memory/file_memory.py` at line 145, where `self.user_path = self.base_path / user_id` directly concatenates the user-supplied `user_id` parameter without sanitization. No validation or path normalization is applied before the join operation or before calling `mkdir()` and writing five JSON files (config.json, short_term.json, long_term.json, entities.json, summaries.json) under the traversed path. An attacker with ability to control the user_id parameter—either directly via the Python API, indirectly through the Agent constructor's memory dict, or via agents.yaml in a job submission endpoint—can inject path traversal sequences like `../../` to write files outside the intended memory directory. The attack requires no authentication and no special filesystem permissions beyond what the application process already holds. Sibling code in SQLiteBackend demonstrates the correct pattern (regex validation), but FileMemory does not implement equivalent checks.
Affected products
- MervinPraison praisonaiagents <1.6.58
Timeline
- 2026-06-13: disclosed: Vulnerability reported to GitHub Advisory Database
- 2026-08-25: patched: Fix released in praisonaiagents >= 1.6.58