CVE-2026-56839
Received Received - Intake

Path Traversal in PraisonAI Prior to 4.6.59

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy workspace. An application that exposes code_read_file, code_search_replace, or code_apply_diff before set_workspace can therefore let prompt-influenced calls read and modify files outside the intended project directory, while explicitly configured workspaces remain effective. This vulnerability is fixed in 4.6.59.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-56839
EUVD
EUVD-2026-77614

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
praisonai praisonai to 4.6.59 (inc)
mervinpraison praisonai to 4.6.59 (exc)
mervinpraison praisonai 4.6.59

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in PraisonAI versions before 4.6.59 allows file read and modification operations to bypass path containment checks when the workspace is not explicitly set. The CODE_TOOLS wrappers initialize the workspace root as None by default, enabling path traversal attacks if set_workspace() is not called first.

Detection Guidance

To detect this vulnerability, check if your PraisonAI version is below 4.6.59. Run: pip show praisonai or check version in code. Also review applications using CODE_TOOLS wrappers for file operations without set_workspace() calls.

Impact Analysis

It allows unauthorized reading and modification of files outside the intended project directory, including sensitive system files. This poses risks to confidentiality and integrity, especially in agentic systems where untrusted prompts influence tool usage.

Compliance Impact

This vulnerability could lead to unauthorized file access and modification outside intended directories, potentially exposing sensitive data. For GDPR, this may violate principles of data protection and integrity. For HIPAA, it risks unauthorized access to protected health information, compromising confidentiality and compliance.

Mitigation Strategies

Upgrade PraisonAI to version 4.6.59 or later. Ensure set_workspace() is called before using code_read_file, code_search_replace, or code_apply_diff. Review file access logs for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56839. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart