CVE-2026-55527: PraisonAI Path Traversal Vulnerability

CVE-2026-55527 Overview

CVE-2026-55527 is a path traversal vulnerability in PraisonAI, a multi-agent teams system maintained by MervinPraison. The flaw resides in the FileMemory constructor within praisonaiagents, where an unsanitized user_id parameter is joined directly into self.user_path. An authenticated caller supplying ../ sequences or path separators can escape the intended memory directory and write JSON data to arbitrary process-writable locations on the host. The issue is tracked as CWE-22: Improper Limitation of a Pathname to a Restricted Directory and is fixed in praisonaiagents version 1.6.58.

Critical Impact
Attackers with the ability to supply a user_id value can write attacker-controlled JSON to any location writable by the PraisonAI process, enabling configuration tampering, code overwrite, and potential agent compromise.

Affected Products

PraisonAI praisonaiagents package prior to version 1.6.58
PraisonAI multi-agent teams system deployments using FileMemory
Applications embedding the vulnerable FileMemory constructor with user-controlled user_id values

Discovery Timeline

2026-08-25 - CVE-2026-55527 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-55527

Vulnerability Analysis

The vulnerability affects FileMemory, a component in the PraisonAI agents memory subsystem responsible for persisting agent memory as JSON files scoped per user. The constructor accepts a user_id argument and concatenates it into a filesystem path used to store memory artifacts. Because the constructor performs no input validation, an attacker who can influence user_id can inject relative traversal sequences such as ../../../etc or absolute path fragments. The resulting write primitive is a partial-content write: attacker-controlled JSON is serialized to a filename derived from the manipulated path, giving the attacker influence over both destination and content.

Root Cause

The root cause is missing input sanitization in the FileMemory.__init__ method within src/praisonai-agents/praisonaiagents/memory/file_memory.py. The constructor treated user_id as a trusted directory name and passed it unchecked into path-joining logic, violating the principle of neutralizing special elements in filesystem paths.

Attack Vector

Exploitation requires the attacker to control the user_id value supplied to FileMemory. In multi-tenant deployments where user_id originates from network-facing API input, an attacker submits a value containing ../ sequences or embedded separators. The agent runtime then serializes memory state to the attacker-chosen path, writing JSON content into arbitrary locations reachable by the process user.

python

# Security patch applied in praisonaiagents 1.6.58
# File: src/praisonai-agents/praisonaiagents/memory/file_memory.py

    "importance_threshold": 0.7,   # Min importance for long-term
    "auto_promote": True,          # Auto-promote important short-term to long-term
}

@staticmethod
def _sanitise_user_id(user_id: str) -> str:
    """Reject path traversal in user_id before using it as a directory name."""
    if not user_id or not isinstance(user_id, str):
        return "default"
    if ".." in user_id or "/" in user_id or "\\" in user_id:
        raise ValueError("user_id must not contain path separators or parent references")
    safe = user_id.strip()
    return safe or "default"

def __init__(
    self,

Source: PraisonAI security commit 2f9677a

The patch introduces _sanitise_user_id, a static method that rejects any user_id containing .., forward slash, or backslash, and falls back to a "default" value for empty or non-string input.

Detection Methods for CVE-2026-55527

Indicators of Compromise

Unexpected JSON files written outside the configured PraisonAI memory directory, particularly in system directories or application configuration paths
Application log entries showing FileMemory initialization with user_id values containing .., /, or \ characters
Modification timestamps on sensitive files matching PraisonAI agent execution windows
Presence of praisonaiagents package versions below 1.6.58 in Software Bill of Materials scans

Detection Strategies

Instrument the application layer to log the raw user_id values passed to FileMemory and alert on any containing path metacharacters
Deploy filesystem integrity monitoring on directories writable by the PraisonAI process user to detect unauthorized JSON writes
Perform static analysis of dependency manifests (requirements.txt, pyproject.toml, Pipfile.lock) to flag vulnerable praisonaiagents versions

Monitoring Recommendations

Enable auditd or equivalent syscall monitoring for open() and write() calls originating from the PraisonAI process with paths outside its designated data directory
Correlate API gateway request logs against FileMemory initialization events to trace attacker-supplied user_id values back to source IPs
Track outbound package installation events to confirm rollout of the patched praisonaiagents 1.6.58 or later

How to Mitigate CVE-2026-55527

Immediate Actions Required

Upgrade praisonaiagents to version 1.6.58 or later across all PraisonAI deployments
Audit application code that passes user-controlled input to the FileMemory constructor and validate user_id at the API boundary
Review the PraisonAI process working directory and parent filesystem for unauthorized JSON files written prior to patching
Rotate any credentials or configuration files stored in locations writable by the PraisonAI process

Patch Information

The fix is available in PraisonAI release v4.6.58 and corresponds to praisonaiagents package version 1.6.58. The patch adds the _sanitise_user_id static method and invokes it before user_id is used in path construction. Full technical detail is available in the GitHub Security Advisory GHSA-gxmw-5f7x-6g22 and the upstream security commit.

Workarounds

Enforce strict allowlist validation on user_id at the API or ingress layer, rejecting any value containing .., /, or \
Run PraisonAI under a dedicated low-privilege service account with a restricted writable filesystem scope
Deploy PraisonAI inside a container with a read-only root filesystem and only the memory directory mounted writable

bash

# Example: constrain PraisonAI writes using systemd sandboxing
# /etc/systemd/system/praisonai.service.d/hardening.conf
[Service]
ReadOnlyPaths=/
ReadWritePaths=/var/lib/praisonai/memory
ProtectSystem=strict
ProtectHome=true
NoNewPrivileges=true

# Then upgrade the vulnerable package
pip install --upgrade 'praisonaiagents>=1.6.58'