CVE-2026-39307
Zip Slip Vulnerability in PraisonAI Template Extraction
Publication date: 2026-04-07
Last updated on: 2026-04-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| praison | praisonai | to 4.5.112 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-39307 is a high-severity vulnerability known as a Zip Slip Arbitrary File Write in the PraisonAI package versions up to 4.5.112. It occurs in the templates installation feature where the application uses Python's zipfile.extractall() method without validating the paths of files inside the ZIP archive.
This lack of validation allows an attacker to craft a malicious ZIP archive containing directory traversal paths (e.g., ../../../../tmp/evil.sh) that can write files outside the intended extraction directory when the template is installed.
An attacker can exploit this by tricking a user into installing a malicious template via the CLI command, causing arbitrary files to be written anywhere on the victim's filesystem.
How can this vulnerability impact me? :
This vulnerability can lead to arbitrary files being written anywhere on your system, including critical system files, user configuration files, or application code.
Such unauthorized file writes can cause system corruption, compromise application integrity, and potentially allow full Remote Code Execution (RCE) by an attacker.
The CVSS score of 8.1 indicates a high severity impact with low attack complexity and no privileges required, meaning it is relatively easy for an attacker to exploit if a user installs a malicious template.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious template installation commands that involve downloading and extracting ZIP archives from untrusted sources.
Specifically, look for usage of the CLI command pattern: `praisonai templates install github:attacker/malicious_template` or similar commands that install templates from external repositories.
Additionally, you can check your filesystem for unexpected files created outside the intended extraction directory, such as files in `/tmp/` or other unusual locations.
- Use command-line tools to search for suspicious files, for example: `find /tmp -name 'zip_slip_pwned.txt'`
- Monitor process execution logs or shell history for the use of `praisonai templates install` commands with untrusted sources.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade PraisonAI to version 1.5.113 or later, where this vulnerability is fixed.
Until the upgrade is applied, avoid installing templates from untrusted or external sources that could contain malicious ZIP archives.
Implement monitoring to detect any unauthorized file writes outside the intended extraction directories.
Consider restricting user permissions to limit the impact of arbitrary file writes.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.