CVE-2026-47397 in PraisonAI
Summary
by MITRE • 07/21/2026
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary paths. `write_file` skips path validation when `workspace=None` (always `None` in production). Version 4.6.40 fixes the issue.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The PraisonAI multi-agent teams system presents a critical path traversal vulnerability that affects versions prior to 4.6.40, creating a significant security risk for organizations relying on automated agent workflows. This vulnerability stems from insufficient input validation within the file writing functionality, specifically when the workspace parameter remains unset or defaults to None in production environments. The flaw allows attackers to manipulate hidden metadata within webpages to inject malicious content into arbitrary filesystem locations, effectively bypassing normal access controls and authorization mechanisms that should protect system resources.
The technical implementation of this vulnerability exploits a fundamental design oversight where the write_file function fails to validate file paths when workspace is set to None, which is the default configuration in production deployments. This condition creates an unrestricted write scenario where attacker-controlled content can be written to any location accessible by the agent process, potentially including system directories, configuration files, or other sensitive locations within the filesystem. The vulnerability operates at the application layer and specifically targets the file system interaction components of the multi-agent architecture, making it particularly dangerous in environments where agents operate with elevated privileges.
The operational impact of this vulnerability extends beyond simple unauthorized file creation, as it enables attackers to potentially compromise the integrity of the entire system. An attacker could leverage this flaw to deploy malicious code, modify critical configuration files, or establish persistence mechanisms within the PraisonAI environment. The vulnerability is particularly concerning given that the default production configuration always sets workspace to None, meaning all installations are potentially vulnerable unless explicitly configured otherwise. This widespread exposure affects organizations using the platform for automated workflows, data processing, and multi-agent collaboration scenarios where system integrity is paramount.
Security mitigations for this vulnerability primarily involve upgrading to version 4.6.40 or later, which implements proper path validation when workspace is None. Organizations should also conduct thorough security reviews of their existing PraisonAI deployments to identify any potential exploitation that may have occurred before the patch was applied. Additional protective measures include implementing strict file system access controls for agent processes, monitoring file creation activities in production environments, and ensuring that all agents operate with minimal required privileges to limit the potential impact of such vulnerabilities. This issue aligns with CWE-22 Path Traversal and ATT&CK technique T1059 Command and Scripting Interpreter, specifically targeting the persistence and execution phases of an attack lifecycle where unauthorized code deployment occurs through compromised automation systems. Organizations should also consider implementing network segmentation and application whitelisting policies to further reduce the attack surface and limit potential lateral movement within their infrastructure.