CVE-2026-55540

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing read_file and other code tools to access files outside the configured workspace. This issue is fixed in version 4.6.58.

Affected

MervinPraison · PraisonAI

CVSS v3.1 GITHUB

7.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

EPSS

0.39% chance of exploitation in the next 30 days, 32nd percentile

Published

2026-08-25

Updated

2026-08-27

Proof-of-concept exploits (1)

• advisories/GHSA-ch89-h4r2-c8f8

References

• CVE Record
• NVD entry