CVE-2026-39308: PraisonAI Path Traversal Vulnerability

CVE-2026-39308 Overview

CVE-2026-39308 is a path traversal vulnerability in PraisonAI, a multi-agent teams system. Prior to version 1.5.113, PraisonAI's recipe registry publish endpoint writes uploaded recipe bundles to a filesystem path derived from the bundle's internal manifest.json before verifying that the manifest name and version match the HTTP route. A malicious publisher can place ../ traversal sequences in the bundle manifest and cause the registry server to create files outside the configured registry root, even though the request is ultimately rejected with HTTP 400.

Critical Impact

This arbitrary file write vulnerability allows attackers to write malicious files to arbitrary locations on the registry host filesystem, potentially leading to code execution, configuration tampering, or system compromise.

Affected Products

• PraisonAI versions prior to 1.5.113
• Deployments exposing the recipe registry publish flow
• Registry instances running without token authentication or with publish access granted

Discovery Timeline

• 2026-04-07 - CVE-2026-39308 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-39308

Vulnerability Analysis

This vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory) exists due to improper input validation in the recipe registry publish endpoint. The registry server processes uploaded recipe bundles by extracting the path from the bundle's internal manifest.json file and using this path to write the bundle to the filesystem. The critical flaw is that the server writes the files before performing validation checks on whether the manifest name and version match the HTTP route parameters.

An attacker can craft a malicious recipe bundle containing path traversal sequences such as ../ within the manifest.json file. When uploaded, the server will write the bundle contents to a location outside the intended registry root directory before the validation check rejects the request with an HTTP 400 error. This creates a time-of-check time-of-use (TOCTOU) issue where the malicious file write has already completed by the time the validation fails.

The vulnerability affects all deployments that expose the recipe registry publish flow. If the registry is configured without token authentication, any network client that can reach the service can exploit this vulnerability. Even when token authentication is enabled, any user with publish access can still trigger the arbitrary file write.

Root Cause

The root cause is improper ordering of operations in the publish endpoint. The application writes files to the filesystem based on user-controlled input from the manifest.json before performing validation to ensure the manifest values are safe and match the expected route parameters. The lack of proper path canonicalization and traversal sequence filtering before file write operations allows attackers to escape the configured registry root directory.

Attack Vector

The attack is conducted over the network and requires low privileges. An attacker with network access to the recipe registry service can exploit this vulnerability by:

1. Crafting a malicious recipe bundle with path traversal sequences (e.g., ../../etc/cron.d/malicious) in the manifest.json file
2. Uploading the malicious bundle to the registry publish endpoint
3. The server writes the bundle contents to the traversed path before validating the manifest
4. Even though the request returns HTTP 400, the malicious file has already been written to the target location

The vulnerability is exploitable without user interaction. For technical details on the vulnerability, see the GitHub Security Advisory.

Detection Methods for CVE-2026-39308

Indicators of Compromise

• Unexpected files appearing outside the configured recipe registry root directory
• Web server logs showing HTTP 400 responses to publish endpoint requests with suspicious bundle names
• File system activity in sensitive directories (e.g., /etc/cron.d/, /var/www/, application directories) originating from the registry server process
• Malformed manifest.json files containing ../ sequences in recipe bundles

Detection Strategies

• Monitor file system write operations from the PraisonAI registry process for attempts to write outside the registry root
• Implement web application firewall rules to detect and block requests containing path traversal patterns in uploaded bundles
• Review web server access logs for repeated HTTP 400 responses to the recipe publish endpoint
• Deploy file integrity monitoring on critical system directories to detect unauthorized file creation

Monitoring Recommendations

• Enable detailed logging for the recipe registry publish endpoint to capture all upload attempts and validation failures
• Set up alerts for any file write operations by the registry service to directories outside the expected registry root path
• Monitor for creation of executable files or configuration files in system directories
• Implement real-time log analysis to detect patterns of exploitation attempts

How to Mitigate CVE-2026-39308

Immediate Actions Required

• Upgrade PraisonAI to version 1.5.113 or later immediately
• If immediate upgrade is not possible, disable or restrict access to the recipe registry publish endpoint
• Implement network-level access controls to limit which hosts can reach the registry service
• Review file systems for any evidence of exploitation and remove unauthorized files

Patch Information

The vulnerability is fixed in PraisonAI version 1.5.113. The patch ensures that manifest validation occurs before any file write operations, preventing path traversal sequences from being used to write files outside the configured registry root. Organizations should update to this version or later as soon as possible.

For additional details, refer to the GitHub Security Advisory for GHSA-r9x3-wx45-2v7f.

Workarounds

• Disable the recipe registry publish endpoint if not required for your deployment
• Implement strict network access controls to limit publish access to trusted hosts only
• Require token authentication and restrict publish tokens to only verified, trusted users
• Deploy the registry service in a containerized environment with restricted filesystem access to limit the impact of potential exploitation

# Example: Restrict network access to recipe registry using iptables
# Allow only specific trusted IP ranges to access the registry port
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP