CVE-2026-60088

PraisonAI before 4.6.78 Path Traversal via Custom Commands

CVSS 6.8 MEDIUMEPSS 0.1%CWE-22

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 6.8EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

11 jul 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path traversal sequences like @../outside_secret.txt or absolute paths in project command files to exfiltrate process-readable files into model prompts.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Produtos afetados

MervinPraison · PraisonAI

Referências

https://github.com/MervinPraison/PraisonAI/commit/3aa9cbc2bd49c23a32be0a89a5e620d13d843eab https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-xpx6-x8c2-mw5w https://www.vulncheck.com/advisories/praisonai-before-path-traversal-via-custom-commands