CVE-2026-57129 in praisonaiagents
Summary
by MITRE • 09/14/2026
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability identified within PraisonAI prior to version 1.6.59 represents a critical path traversal and arbitrary file read flaw rooted in the MentionsParser component, specifically affecting the _process_file_mention method. As a multi-agent team system designed to orchestrate complex workflows involving multiple AI agents, PraisonAI relies heavily on dynamic input handling where users or automated bots can reference external resources such as files within a workspace context. The core technical flaw lies in how the parser resolves these file references. When processing a mention that points to a specific file path, the system initially attempts to resolve it relative to the current workspace directory. However, if this resolution fails or is bypassed due to malformed input, the code falls back directly to instantiating a Path object using the raw user-supplied file_path value without performing any necessary security validations. This lack of validation means there are no checks for path traversal sequences such as dot-dot-slash patterns, nor is there any verification that the resolved path remains within the intended workspace boundaries or does not resolve through symbolic links to sensitive areas of the filesystem outside the allowed scope.
This architectural weakness allows an attacker with access to the PraisonAI interface—whether a human user interacting via prompts, another bot agent in the workflow, or an automated system—to read arbitrary files accessible by the process running the application. The operational impact is severe because it effectively bypasses isolation mechanisms intended to keep agents confined to their designated data environments. By supplying carefully crafted file paths containing traversal characters, an attacker can navigate up directory levels and access sensitive information stored elsewhere on the host machine. This includes but is not limited to cloud provider credentials, API keys, environment variable files containing secrets, proprietary source code repositories, and system configuration files that may reveal internal network topology or security policies. The ability to exfiltrate such data compromises confidentiality integrity across the entire infrastructure managed by PraisonAI, potentially leading to further compromise of dependent systems if those leaked credentials are reused elsewhere.
From a classification perspective, this vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory and CWE-94: Improper Control of Generation of Code (Code Injection) in contexts where file inclusion is involved, though primarily it is an information disclosure issue categorized under CWE-530: Exposure of Sensitive Information to an Unauthorized Actor. In terms of the MITRE ATT&CK framework, this behavior maps directly to T1083: File and Directory Discovery and T1005: Data from Local System, as the attacker leverages application logic flaws to enumerate and extract sensitive local data without direct system-level access tools. The vulnerability exploits the trust placed in input sanitization within multi-agent orchestration layers where dynamic resource loading is a core feature rather than an edge case.
Mitigation strategies must focus on strict input validation and secure path resolution practices. For organizations still running versions prior to 1.6.59, immediate upgrading to version 1.6.59 or later is the primary remediation step as it addresses this specific parsing logic flaw. In environments where patching may not be immediately feasible, defensive coding measures should include implementing canonical path resolution that verifies the final resolved absolute path starts with the expected workspace root directory before any file operations are permitted. Additionally, developers should enforce allow-lists for accessible directories and disable symbolic link following during file access to prevent bypasses via symlink attacks. Runtime monitoring solutions can also be configured to detect unusual patterns of file system reads originating from PraisonAI processes that deviate from standard operational paths, providing an additional layer of defense against exploitation attempts targeting this specific vulnerability vector.