CVE-2026-55540: PraisonAI Path Traversal Vulnerability

CVE-2026-55540 Overview

CVE-2026-55540 is a path traversal vulnerability in PraisonAI, a multi-agent teams system for orchestrating AI workflows. The flaw resides in the is_path_within_directory() function, which uses os.path.abspath() instead of os.path.realpath() when enforcing the workspace boundary. A symbolic link placed inside the workspace can point to files outside the configured directory and still pass the boundary check. This enables read_file and other code tools to access files outside the intended workspace scope. The issue is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Attackers who can influence workspace contents can read arbitrary files on the host through symlink-based traversal, exposing secrets, source code, and system configuration.

Affected Products

PraisonAI versions prior to 4.6.51
PraisonAI read_file and related code tools
Fixed in PraisonAI version 4.6.58

Discovery Timeline

2026-08-25 - CVE-2026-55540 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-55540

Vulnerability Analysis

PraisonAI enforces a workspace directory boundary to constrain file system access performed by agent tools. The is_path_within_directory() helper computes the canonical form of a requested path with os.path.abspath() and compares it to the workspace root. os.path.abspath() normalizes .. sequences and produces an absolute path but does not resolve symbolic links. As a result, a symlink located inside the workspace that targets a path outside the workspace resolves to an in-scope path string during the check while dereferencing to an out-of-scope file at read time.

An attacker who can place or influence files inside the workspace directory — for example, through an agent that writes files, a shared workspace, or a poisoned repository — can create a symlink pointing to arbitrary paths. Subsequent calls to read_file or other tools that rely on the boundary check will follow the symlink and disclose file contents. Successful exploitation requires user interaction, reflecting the multi-step nature of placing a symlink and invoking a downstream tool.

Root Cause

The root cause is the incorrect choice of path-normalization primitive. os.path.abspath() only performs lexical normalization; it does not traverse symbolic links. Secure directory-containment checks require os.path.realpath() (or equivalent canonicalization) on both the candidate path and the boundary root before performing the prefix comparison.

Attack Vector

Exploitation proceeds over the network through the PraisonAI agent interface. An attacker triggers an agent action that creates a symlink inside the configured workspace pointing to a sensitive file such as /etc/passwd, a .env file, or SSH keys. A follow-up read_file tool invocation supplies the in-workspace symlink path, which passes is_path_within_directory() and is then opened, returning the target file's contents.

python

# Hardening added in the security patch to related components
# Source: https://github.com/MervinPraison/PraisonAI/commit/2f9677abb2ea68eab864ee8b6a828fd0141612e1

@staticmethod
def _sanitise_user_id(user_id: str) -> str:
    """Reject path traversal in user_id before using it as a directory name."""
    if not user_id or not isinstance(user_id, str):
        return "default"
    if ".." in user_id or "/" in user_id or "\\" in user_id:
        raise ValueError("user_id must not contain path separators or parent references")
    safe = user_id.strip()
    return safe or "default"

The commit also introduces bearer-token authorization for the PraisonAI server, tightening the exposure surface for path-handling code paths. See the GitHub Security Advisory GHSA-ch89-h4r2-c8f8 for the full advisory.

Detection Methods for CVE-2026-55540

Indicators of Compromise

Symbolic links inside PraisonAI workspace directories whose targets resolve outside the workspace root
Agent tool invocations of read_file returning contents of sensitive system paths such as /etc/passwd, ~/.ssh/, or .env files
Unexpected file reads recorded in PraisonAI logs referencing paths that lexically appear in-scope but dereference elsewhere

Detection Strategies

Audit workspace directories for symbolic links and compare os.path.abspath() and os.path.realpath() outputs to flag divergence
Inspect PraisonAI application logs for high-volume or anomalous read_file tool calls issued by agents
Track PraisonAI package versions across environments and alert on any deployment older than 4.6.58

Monitoring Recommendations

Enable file access auditing (auditd, EDR telemetry) on hosts running PraisonAI to record reads of sensitive files by the PraisonAI process
Forward PraisonAI logs to a centralized SIEM and correlate tool invocations with symlink creation events
Alert on outbound transfers of large file contents from PraisonAI worker processes

How to Mitigate CVE-2026-55540

Immediate Actions Required

Upgrade PraisonAI to version 4.6.58 or later immediately
Inventory all PraisonAI deployments and confirm the running version
Review existing workspace directories for pre-existing symlinks that resolve outside the workspace and remove them

Patch Information

The fix is available in PraisonAI 4.6.58. See GitHub Release v4.6.58 and the remediation commit. The patch hardens input validation, adds bearer-token authorization on the server, and replaces the flawed workspace boundary check so that symbolic links are resolved before comparison.

Workarounds

Run PraisonAI under a dedicated low-privilege user account with no read access to sensitive system files
Mount the workspace directory with nosymfollow where supported, or disable symlink creation in the workspace
Restrict which agents and users can write to the workspace to prevent introduction of malicious symlinks

bash

# Upgrade PraisonAI to the patched release
pip install --upgrade 'praisonai>=4.6.58'

# Audit an existing workspace for symlinks pointing outside the root
WORKSPACE=/path/to/praisonai/workspace
find "$WORKSPACE" -type l -printf '%p -> %l\n' | \
  while read link arrow target; do
    real=$(readlink -f "$link")
    case "$real" in
      "$WORKSPACE"/*) ;;
      *) echo "OUT-OF-SCOPE SYMLINK: $link -> $real" ;;
    esac
  done