CVE-2026-57119: PraisonAI Path Traversal Vulnerability

CVE-2026-57119 Overview

CVE-2026-57119 is a path traversal vulnerability [CWE-22] in PraisonAI, a multi-agent teams system maintained by MervinPraison. The unauthenticated Jobs API endpoint POST /api/v1/runs accepts an absolute or traversing agent_file path and passes it to the job executor without a workspace allowlist or boundary check. A remote unauthenticated caller can force the server to open arbitrary files accessible to the service account. This exposes credentials, API keys, environment variables, and other local data. The issue is fixed in version 4.6.59.

Critical Impact
An unauthenticated remote attacker can read arbitrary files readable by the PraisonAI service account, resulting in disclosure of secrets, tokens, and configuration data.

Affected Products

PraisonAI versions prior to 4.6.59
PraisonAI Jobs API (POST /api/v1/runs)
Deployments exposing the PraisonAI HTTP interface without a network boundary

Discovery Timeline

2026-09-14 - CVE-2026-57119 published to NVD
2026-09-16 - Last updated in NVD database
Fix released - PraisonAI v4.6.59 addresses the vulnerability

Technical Details for CVE-2026-57119

Vulnerability Analysis

The Jobs API in PraisonAI exposes an endpoint that launches agent runs based on an agent_file parameter supplied by the caller. Before version 4.6.59, the request handler forwarded the supplied path directly to the job executor without validating that it resides within an approved workspace directory. Because the endpoint does not require authentication, any network-reachable client can invoke it.

The executor then opens the file using the privileges of the PraisonAI service account. When the account has access to typical deployment artifacts such as .env files, cloud credential caches, SSH keys, or configuration files, those contents are exposed through the job execution flow. The vulnerability affects confidentiality only; integrity and availability are not directly impacted.

Root Cause

The root cause is missing input validation on a filesystem path accepted from an untrusted source. Neither an allowlist of permitted workspace roots nor a canonicalization-and-boundary check was applied to the agent_file parameter. Combined with the absence of authentication on the Jobs API, this yields an unauthenticated arbitrary file read primitive.

Attack Vector

Exploitation requires network access to the PraisonAI HTTP service. An attacker sends a POST /api/v1/runs request supplying an absolute path such as /etc/passwd or a traversal sequence such as ../../../../etc/shadow in the agent_file field. The server dereferences the path within the service account's context and the file contents are returned or processed through the run pipeline. No user interaction, credentials, or prior foothold is required.

python

# Security patch excerpt from src/praisonai-agents/praisonaiagents/approval/registry.py
# Hardened input validation and access controls in v4.6.59
def is_yaml_approved(self, tool_name: str) -> bool:
    try:
        if tool_name not in self._yaml_approved_tools.get():
            return False
    except LookupError:
        return False
    if self.get_risk_level(tool_name) == "critical":
        return False
    return True

# Source: https://github.com/MervinPraison/PraisonAI/commit/2adfe7e8323f6deec66925cf15a885b6238895e9

Detection Methods for CVE-2026-57119

Indicators of Compromise

HTTP POST requests to /api/v1/runs containing agent_file values with absolute paths (starting with / or a drive letter) or traversal sequences (../, ..\\, URL-encoded %2e%2e%2f).
Access log entries showing the PraisonAI service reading files outside the intended workspace directory, such as /etc/passwd, .env, id_rsa, or cloud credential files.
Outbound egress from the PraisonAI host to unfamiliar destinations shortly after suspicious /api/v1/runs calls.

Detection Strategies

Deploy a web application firewall or reverse proxy rule that inspects the JSON body of /api/v1/runs and blocks requests where agent_file is not a relative path within the expected workspace.
Enable file-access auditing (auditd on Linux) on sensitive directories such as /etc, /root, and application secret stores, and correlate reads by the PraisonAI process with inbound HTTP requests.
Alert on any HTTP 200 response from /api/v1/runs where the request body contains parent-directory or absolute-path indicators.

Monitoring Recommendations

Forward PraisonAI application logs and host process telemetry to a centralized log platform for correlation of API calls with filesystem activity.
Monitor for anomalous parent-process to file-open patterns originating from the PraisonAI service account.
Track version identifiers in deployment inventories to identify hosts still running PraisonAI releases earlier than 4.6.59.

How to Mitigate CVE-2026-57119

Immediate Actions Required

Upgrade PraisonAI to version 4.6.59 or later on all deployments.
Restrict network exposure of the PraisonAI Jobs API to trusted internal networks or place it behind an authenticating reverse proxy.
Rotate any secrets, API keys, and tokens that were readable by the PraisonAI service account if the API was previously exposed to untrusted networks.

Patch Information

The fix is included in PraisonAI v4.6.59. Technical details are documented in the GitHub Security Advisory GHSA-p4pj-vh7h-6cqh and the remediation commit, which hardens input validation and adds boundary checks in the job executor.

Workarounds

Block or filter POST /api/v1/runs at a reverse proxy so that only relative paths within the designated workspace directory are accepted in the agent_file field.
Run the PraisonAI process under a dedicated low-privilege service account with a chroot or filesystem namespace that limits readable paths to the workspace only.
Remove secret material from the host filesystem where PraisonAI runs and inject credentials at runtime through a secrets manager scoped to the specific job.

bash

# Example reverse proxy filter (nginx) to reject absolute or traversing agent_file values
location = /api/v1/runs {
    if ($request_body ~* "\"agent_file\"\s*:\s*\"(/|[A-Za-z]:|\.\.)") {
        return 400;
    }
    proxy_pass http://praisonai_backend;
}