CVE-2026-61431: PraisonAI Path Traversal Vulnerability

CVE-2026-61431 Overview

CVE-2026-61431 is a path traversal vulnerability in PraisonAI versions before 4.6.78. The flaw resides in the ContextGatherer component, which fails to validate include paths declared in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences such as ../ to read arbitrary files outside the intended workspace. The contents of those files are then embedded in the generated context bundle. The issue is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Arbitrary local file disclosure through crafted include directives, exposing source code, credentials, and other sensitive files reachable by the PraisonAI process.

Affected Products

PraisonAI versions prior to 4.6.78
ContextGatherer component processing .praisoncontext files
ContextGatherer component processing .praisoninclude files

Discovery Timeline

2026-07-10 - CVE-2026-61431 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-61431

Vulnerability Analysis

PraisonAI aggregates workspace files into a context bundle that is later handed to language model agents. The ContextGatherer module reads directives from .praisoncontext and .praisoninclude files and resolves each entry against the filesystem. The resolver does not confirm that the resolved target remains within the workspace root. As a result, a directive containing ../../../etc/passwd or an absolute path such as /home/user/.ssh/id_rsa is followed and read. The file contents are then written into the context bundle delivered to the caller or downstream model.

Root Cause

The root cause is missing canonicalization and containment checks on user-controlled paths. ContextGatherer treats include entries as trusted input rather than validating that the normalized absolute path is a descendant of the workspace directory. Because the vulnerable code accepts absolute and relative traversal sequences equally, any attacker who can influence the contents of .praisoncontext or .praisoninclude can pivot to file read outside the intended scope.

Attack Vector

Exploitation requires local access and user interaction, consistent with the CVSS vector AV:L/UI:P. A typical scenario involves an attacker committing a malicious .praisoninclude file to a repository, sharing a workspace archive, or convincing a developer to open a crafted project. When PraisonAI processes the workspace, the traversal payloads are resolved and the target files are exfiltrated into the context bundle, which may then be transmitted to remote model endpoints or logged.

python

# Related cleanup from the fixing commit removed an orphaned legacy handler
# in src/praisonai/praisonai/integration/_legacy_handlers.py
-"""Shared legacy @aiui.reply handlers for bundled default apps."""
-
-from __future__ import annotations
-
-
-def register_legacy_reply(aiui, *, agent_name: str = "PraisonAI"):
-    """Register callback-only reply handler when ``PRAISONAI_HOST_LEGACY=1``."""
-
-    @aiui.reply
-    async def legacy_reply(message: str, session_id: str = "default"):
-        from praisonaiagents import Agent
-
-        agent = Agent(
-            name=agent_name,
-            instructions="You are a helpful assistant.",
-            llm="gpt-4o-mini",
-        )
-        return agent.run(message)

Source: GitHub commit 1620b49. The commit that resolves the advisory also removes unreferenced legacy code shown above; the actual path validation logic is described in the GitHub Security Advisory GHSA-q7m5-3jmv-vm48.

Detection Methods for CVE-2026-61431

Indicators of Compromise

Presence of .praisoncontext or .praisoninclude files containing absolute paths or ../ sequences pointing outside the project directory.
Generated PraisonAI context bundles that contain contents of system files such as /etc/passwd, SSH keys, or environment files.
Read events on sensitive files by the PraisonAI process outside its workspace root.

Detection Strategies

Perform static scans of repositories and workspace archives for include directives that resolve outside the project root.
Instrument the PraisonAI runtime to log every path resolved by ContextGatherer and flag paths that escape the workspace boundary.
Compare the PraisonAI version in use against 4.6.78 and inventory any installations running earlier releases.

Monitoring Recommendations

Enable filesystem auditing on hosts running PraisonAI and alert on reads of credential stores, SSH keys, and /etc files by the PraisonAI process.
Monitor outbound traffic from PraisonAI to model APIs for unusually large context bundles that may indicate exfiltration of unintended files.
Review CI/CD logs for PraisonAI invocations that process untrusted repositories or externally supplied context files.

How to Mitigate CVE-2026-61431

Immediate Actions Required

Upgrade PraisonAI to version 4.6.78 or later on all developer workstations, build agents, and servers.
Audit existing .praisoncontext and .praisoninclude files across repositories for absolute paths or traversal sequences.
Rotate any secrets, tokens, or SSH keys that may have been read into context bundles processed by vulnerable installations.

Patch Information

The fix is delivered in PraisonAI 4.6.78. Details are published in the GitHub Security Advisory GHSA-q7m5-3jmv-vm48 and the corresponding upstream commit. Additional context is available in the VulnCheck advisory. The EPSS score is 0.259% at the 17.4 percentile as of 2026-07-20, indicating low observed exploitation likelihood, though local file disclosure remains a meaningful risk on multi-tenant developer systems.

Workarounds

Run PraisonAI under a dedicated low-privilege user account with filesystem access restricted to the intended workspace directory.
Reject or sanitize .praisoncontext and .praisoninclude files from untrusted sources before invoking PraisonAI.
Use container or sandbox isolation (for example, a read-only bind mount of only the project directory) to constrain the process filesystem view.

bash

# Upgrade PraisonAI to the patched release
pip install --upgrade "praisonai>=4.6.78"

# Verify the installed version
python -c "import praisonai; print(praisonai.__version__)"

# Optional: run PraisonAI inside a read-only sandbox scoped to the workspace
docker run --rm \
  --read-only \
  -v "$(pwd)/workspace:/workspace:ro" \
  -w /workspace \
  praisonai:4.6.78 run