Executive brief
PraisonAI is a multi-agent AI system that processes user prompts and workflows. The application fails to properly validate file paths provided in user input, allowing attackers to read arbitrary files accessible to the process (such as credentials, API keys, environment files, and source code) by crafting malicious file references in prompts or workflow commands.
Technical details
A path traversal vulnerability exists in PraisonAI's MentionsParser._process_file_mention function, which accepts file-mention values but lacks traversal, symlink, and workspace-boundary validation. When workspace-relative path resolution fails, the code falls back to using Path(file_path) without sanitization. An attacker can inject arbitrary file paths through user prompts, bot commands, or workflow inputs to read any file accessible to the process. The vulnerability is fixed in praisonaiagents version 1.6.59 and later.
Affected products
- Mervin Praison PraisonAI prior to 1.6.59
Timeline
- 2026-09-14: disclosed
- 2026-06-17: patched: Fix released in version 1.6.59