# CVE-2026-57129: PraisonAI path traversal in file mention parsing

Source: https://junglewise.ai/threats/cve-2026-57129-praisonai-path-traversal-in-file-mention-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-57129 · Severity: high · CVSS 7.5 · Published 2026-09-14

PraisonAI is a multi-agent AI system that processes user prompts and workflows. The application fails to properly validate file paths provided in user input, allowing attackers to read arbitrary files accessible to the process (such as credentials, API keys, environment files, and source code) by crafting malicious file references in prompts or workflow commands.

Technologies: [praisonaiagents (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonaiagents). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-57129 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57129 being exploited in the wild.

**How severe is CVE-2026-57129?** High severity, with a CVSS score of 7.5, published 14 September 2026.

**Which products and versions are affected?** praisonaiagents (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.59.

**Is there a fix for CVE-2026-57129?** Yes. praisonaiagents (PyPI): upgrade to 1.6.59 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57129 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57129?** Check whether you run praisonaiagents (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonaiagents (PyPI): upgrade to 1.6.59 or later

  ```sh
  pip install "praisonaiagents>=1.6.59"
  ```


## Technical details

A path traversal vulnerability exists in PraisonAI's MentionsParser._process_file_mention function, which accepts file-mention values but lacks traversal, symlink, and workspace-boundary validation. When workspace-relative path resolution fails, the code falls back to using Path(file_path) without sanitization. An attacker can inject arbitrary file paths through user prompts, bot commands, or workflow inputs to read any file accessible to the process. The vulnerability is fixed in praisonaiagents version 1.6.59 and later.

## Affected products

- Mervin Praison PraisonAI prior to 1.6.59

## Identifiers

- CVE-2026-57129
- GHSA-2rcg-mm5h-xchx
- PYSEC-2026-3527

## Timeline

- 2026-09-14: disclosed
- 2026-06-17: patched: Fix released in version 1.6.59

## References

- [https://github.com/MervinPraison/PraisonAI/commit/b4270173d4123fb1ee8910588f0896668ee21b59](https://github.com/MervinPraison/PraisonAI/commit/b4270173d4123fb1ee8910588f0896668ee21b59)
- [https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59](https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59)

## Related threats

- [PraisonAI SearxNG URL validation bypass in search tools](https://junglewise.ai/threats/cve-2026-57143-praisonai-server-side-request-forgery-ssrf-in-searxng-search-web)
- [PraisonAI missing access control in API endpoints](https://junglewise.ai/threats/cve-2026-57118-praisonai-agentteam-launch-exposes-unauthenticated-remote-agent)
- [PraisonAI legacy SSE endpoint CORS and authentication bypass](https://junglewise.ai/threats/cve-2026-57112-praisonai-legacy-sse-endpoint-cors-and-authentication-bypass)
- [PraisonAI IMAP injection in email tools](https://junglewise.ai/threats/cve-2026-57130-praisonai-imap-injection-in-email-tools)
- [PraisonAI authentication bypass in SSE server endpoints](https://junglewise.ai/threats/cve-2026-57128-praisonai-authentication-bypass-in-sse-server-endpoints)