CVE-2026-55527: praisonaiagents FileMemory path traversal arbitrary file write

CVE-2026-55527 · Severity: high · CVSS 7.1 · Published 2026-08-25

PraisonAI Agents is a Python library for building multi-agent AI systems. The FileMemory component, which persists agent conversation history and state to JSON files on disk, fails to validate the user_id parameter before using it to construct filesystem paths. An attacker can supply path traversal sequences (e.g., `../../etc/evil`) to write JSON files to any writable location on the system, potentially overwriting application configs, cron jobs, or other critical files.

Technologies: praisonaiagents (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55527 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55527 being exploited in the wild.
How severe is CVE-2026-55527?
High severity, with a CVSS score of 7.1, published 25 August 2026.
Which products and versions are affected?
praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.58.
Is there a fix for CVE-2026-55527?
Yes. praisonaiagents (PyPI): upgrade to 1.6.58 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55527 attacked?
It is attacked over the network.
Am I affected by CVE-2026-55527?
Check whether you run praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonaiagents (PyPI): upgrade to 1.6.58 or later
    pip install "praisonaiagents>=1.6.58"

Technical details

The vulnerability exists in `praisonaiagents/memory/file_memory.py` at line 145, where `self.user_path = self.base_path / user_id` directly concatenates the user-supplied `user_id` parameter without sanitization. No validation or path normalization is applied before the join operation or before calling `mkdir()` and writing five JSON files (config.json, short_term.json, long_term.json, entities.json, summaries.json) under the traversed path. An attacker with ability to control the user_id parameter—either directly via the Python API, indirectly through the Agent constructor's memory dict, or via agents.yaml in a job submission endpoint—can inject path traversal sequences like `../../` to write files outside the intended memory directory. The attack requires no authentication and no special filesystem permissions beyond what the application process already holds. Sibling code in SQLiteBackend demonstrates the correct pattern (regex validation), but FileMemory does not implement equivalent checks.

Affected products

  • MervinPraison praisonaiagents <1.6.58

Identifiers

  • CVE-2026-55527
  • GHSA-gxmw-5f7x-6g22
  • PYSEC-2026-3902

Timeline

  • 2026-06-13: disclosed: Vulnerability reported to GitHub Advisory Database
  • 2026-08-25: patched: Fix released in praisonaiagents >= 1.6.58

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.