PraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitor | Advisories

Advisories

PraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitor

severity: high
date: 6/18/2026
Affecting: PraisonAI >= 0, < 1.5.115
CVE: CVE-2026-56078
CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSS: 8.7
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-766v-q9x3-g744
https://github.com/MervinPraison/PraisonAI
Description: PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs when building file paths. Attackers can include traversal sequences like ../ in agent IDs to read, write, or overwrite arbitrary files, enabling sensitive disclosure, denial of service, or code execution.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo