PraisonAI: Path traversal in GitHub template cache allows file write and deletion
Summary
PraisonAI's template loader does not validate the ref and path segments of GitHub template URIs before it builds a cache path. An attacker who can get PraisonAI to load a crafted template URI, for example with ../ sequences in the ref, can create a .cache_meta.json file outside the cache. If a normal cache entry for the same owner, repo and template already exists, the attacker can also make PraisonAI delete an attacker-selected directory. Exploitation requires user interaction and control over the template input.
Affected
- PraisonAI (Python package praisonai) from 2.6.0 before 4.6.59
Fixed in
- Version 4.6.59 or later
Workaround
Unknown.
- No vendor workaround is known. Until the update is applied, do not let untrusted users or inputs supply template URIs.
Exploitation
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- Not listed in CISA KEV. EPSS 0.00405 (low).
- No in-the-wild exploitation reported. The advisory contains a reproduction snippet, and public exploit code cannot be ruled out.
Our recommendation
- Upgrade PraisonAI to version 4.6.59 or later.
- Until then, do not let untrusted users supply template URIs.
- Run PraisonAI under a restricted service account without write access to sensitive directories.
- Check whether PraisonAI is installed (for example with pip show praisonai) on developer, automation and internet-facing hosts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-f44v-7qgw-9gh9 github.com
- OSV: CVE-2026-57113 osv.dev
- OSV: GHSA-f44v-7qgw-9gh9 osv.dev
- CIRCL Vulnerability Lookup: GHSA-f44v-7qgw-9gh9 vulnerability.circl.lu
- Strix: CVE-2026-57113 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:57.
Original description (NVD)
PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.