# CVE-2026-57145: PraisonAI path traversal in multiedit tool

Source: https://junglewise.ai/threats/cve-2026-57145-praisonai-path-traversal-in-multiedit-tool  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-57145 · Severity: critical · CVSS 9.1 · Published 2026-09-14

PraisonAI is a multi-agent automation system that uses LLMs to coordinate team tasks. A flaw in its file-editing tool allows AI-controlled agents to read and write arbitrary files accessible to the application process, including sensitive configuration files, credentials, and system files. An attacker can exploit this to steal secrets, establish persistence, or corrupt application functionality.

Technologies: [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-57145 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57145 being exploited in the wild.

**How severe is CVE-2026-57145?** Critical severity, with a CVSS score of 9.1, published 14 September 2026.

**Which products and versions are affected?** praisonai (PyPI) ECOSYSTEM:introduced=0,fixed=4.6.61.

**Is there a fix for CVE-2026-57145?** Yes. praisonai (PyPI): upgrade to 4.6.61 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57145 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57145?** Check whether you run praisonai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- praisonai (PyPI): upgrade to 4.6.61 or later

  ```sh
  pip install "praisonai>=4.6.61"
  ```


## Technical details

The vulnerability is a path traversal flaw in src/praisonai/praisonai/tools/multiedit.py where LLM-controlled filepath parameters are passed directly to open() without validation, symlink resolution, workspace boundary checks, or protected-path filtering. An attacker who can influence agent prompts or directives can read arbitrary files via edit/diff operations or overwrite files with write access. No authentication bypass is required if the attacker controls the LLM input; the attack surface is the file permissions of the process user. The fix was released in version 4.6.62.

## Affected products

- Mervin Praison PraisonAI before 4.6.62

## Identifiers

- CVE-2026-57145
- GHSA-29w3-p9w9-wc47
- PYSEC-2026-3500

## Timeline

- 2026-09-14: disclosed
- 2026-06-17: patched

## References

- [https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33](https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33)
- [https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62](https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.62)

## Related threats

- [PraisonAI authentication bypass in A2U event streaming](https://junglewise.ai/threats/cve-2026-57146-praisonai-a2u-incomplete-authentication-fix-leaves-current-serve)
- [PraisonAI sandbox escape when Landlock unavailable](https://junglewise.ai/threats/cve-2026-57144-praisonai-sandlocksandbox-falls-back-to-unrestricted-subprocess)
- [PraisonAI recipe policy bypass via YAML-approved tools](https://junglewise.ai/threats/cve-2026-57142-praisonai-recipe-workflow-policy-can-be-bypassed-by-declaring-and)
- [PraisonAI shell command injection in compute-bridged file tools](https://junglewise.ai/threats/cve-2026-57117-praisonai-compute-bridged-file-tools-allow-shell-command)
- [PraisonAI AgentOS authentication bypass in FastAPI deployment](https://junglewise.ai/threats/cve-2026-57116-praisonai-agentos-remains-unauthenticated-after-incomplete-fix)