CVE-2026-56833 in PraisonAI
Summary
by MITRE • 10/23/2026
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified within PraisonAI versions ranging from 3.8.1 to just before 4.6.59 represents a critical path traversal flaw embedded within the system's Dynamic Context module. This module is responsible for managing filesystem-backed history and terminal-log storage, serving as a central repository for operational data generated by multi-agent teams. The core of the issue lies in how the module constructs file paths when storing or retrieving logs associated with specific agent runs. Specifically, the underlying stores accept run_id and agent_id arguments from tool callers to determine the destination directory structure. However, these inputs are joined directly into filesystem paths without any sanitization or validation logic to reject absolute path specifications or sequences designed for directory traversal such as double dots followed by a forward slash. This lack of input validation creates a significant security gap that undermines the intended isolation boundaries of the application's storage architecture.
From an operational perspective, this flaw allows an attacker with lower-trust privileges who has the ability to invoke these agent-callable tool factories to manipulate file system access beyond the designated Dynamic Context base directory. By supplying carefully crafted values for run_id or agent_id that include absolute paths or traversal sequences, a malicious actor can read sensitive .jsonl and .log files located outside the intended scope of the application. These log files often contain valuable intelligence regarding internal processes, user interactions, API keys, session tokens, or other confidential data generated during normal operations. The ability to exfiltrate this information effectively bypasses access controls designed to restrict agent activities to specific directories, leading to a severe compromise of confidentiality and potentially enabling further lateral movement within the host environment if additional sensitive files are accessible through similar mechanisms.
This vulnerability aligns closely with Common Weakness Enumeration identifier CWE-22, which describes Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The exploitation technique involves manipulating input parameters to escape the restricted directory context, thereby gaining unauthorized access to arbitrary files on the file system. In terms of offensive security frameworks, this behavior is consistent with techniques found in the MITRE ATT&CK catalog under Data from Local System or File and Directory Discovery, where an adversary accesses local data sources that are not directly exposed through network services but remain accessible via application logic flaws. The attack vector relies on the interaction between a lower-trust user and specific tool factories, highlighting how complex multi-agent systems can inadvertently expose internal storage mechanisms to abuse if input validation is insufficiently rigorous across all entry points.
The resolution for this issue was implemented in version 4.6.59 of PraisonAI, where developers addressed the path construction logic to ensure that only relative paths within the configured base directory are accepted. To mitigate similar risks in other systems or during the transition period before upgrading, administrators should enforce strict input validation on all parameters used for file system operations. This includes rejecting absolute paths and stripping or encoding traversal sequences such as .. from user-supplied inputs like run_id and agent_id. Additionally, implementing principle of least privilege by ensuring that application processes run with minimal necessary permissions can limit the impact if a path traversal is successfully executed. Regular security audits focusing on how external inputs influence internal file system operations are essential to maintaining robust defenses against directory traversal attacks in complex software architectures.