CVE-2026-61431: PraisonAI Path Traversal in ContextGatherer (v4.6.78 Fix)

Technical summary

The vulnerability resides in PraisonAI's ContextGatherer component, which processes include path directives from .praisoncontext and .praisoninclude files without adequate path normalization or validation. The component fails to restrict path traversal sequences (../) and absolute paths, enabling CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). When a user processes a workspace containing a malicious configuration file, the ContextGatherer will resolve and include file contents from anywhere on the filesystem that the PraisonAI process has read permission to access. The included content is then bundled into the context output, which may be logged, cached, or transmitted depending on workflow configuration.

Business impact

Exposure of sensitive files can lead to credential theft, intellectual property leakage, and reconnaissance for further attacks. If configuration files are version-controlled or shared across teams, a single malicious .praisoncontext file can compromise multiple users and systems. For organizations using PraisonAI in CI/CD pipelines or shared development environments, this becomes a supply chain risk vector. Affected data may include API keys, private keys, database credentials, source code, and internal documentation—anything readable by the process owner.

Affected systems

PraisonAI versions prior to 4.6.78 are affected. Users running 4.6.78 or later are not vulnerable to this specific path traversal. Exposure is highest in shared or multi-tenant environments where workspace configuration files may be contributed by multiple developers or imported from external sources. Standalone single-user installations face lower risk if local file access is already restricted at the OS level.

Exploitability

Exploitability requires local access and the ability to craft or modify .praisoncontext or .praisoninclude files within or supplied to a target workspace. An attacker cannot exploit this remotely unless they can upload or inject malicious configuration files through another mechanism. The attack requires user interaction in the form of processing/running the PraisonAI context gathering (requires UI:R per CVSS vector). This is not a remote code execution vector; it is a local information disclosure vulnerability with moderate ease of exploitation once the prerequisite file placement is achieved.

Remediation

Upgrade PraisonAI to version 4.6.78 or later, which implements proper path validation in ContextGatherer. The patch should restrict include paths to the workspace directory tree, reject absolute paths, and safely resolve relative paths without allowing traversal sequences. Organizations unable to upgrade immediately should restrict file system permissions on PraisonAI process execution, limit write access to configuration files, and avoid processing untrusted .praisoncontext or .praisoninclude files from external sources.

Patch guidance

Verify against the vendor advisory for exact patch availability and deployment instructions. Update to PraisonAI 4.6.78 or later through the appropriate package manager or release channel used in your deployment. After patching, restart any running PraisonAI instances and re-test workspace context gathering to confirm normal operation. If using PraisonAI in automated pipelines, include the upgrade in your next scheduled maintenance window and validate against your workspace regression tests.

Detection guidance

Monitor PraisonAI process execution for attempts to read files outside the workspace directory. Check .praisoncontext and .praisoninclude files in version control or filesystem backups for absolute paths or traversal sequences (../ patterns). Review PraisonAI logs for unusual file access patterns or errors when processing include paths. On systems with file integrity monitoring or auditd, look for the PraisonAI process opening files in unexpected directories. Organizations using antivirus or EDR tools may tune detection for suspicious path patterns in configuration files before they are processed.

Why prioritize this

Although rated MEDIUM severity with a CVSS score of 5.5, this vulnerability warrants timely attention because: (1) it requires no network access or special privileges, only local file system access and user interaction; (2) information disclosure through file reads can enable downstream attacks such as credential theft or lateral movement; (3) shared development environments and CI/CD pipelines amplify impact; (4) the fix is straightforward (version upgrade) with low deployment friction. It is not critical enough to declare an emergency but should be patched within your next regular maintenance cycle.

Risk score, explained

CVSS 5.5 (MEDIUM) reflects: Attack Vector Local (AV:L)—attacker must have local filesystem access; Access Complexity Low (AC:L)—no special conditions required once files are placed; Privileges None (PR:N)—no elevation needed; User Interaction Required (UI:R)—victim must run or process the workspace; Scope Unchanged (S:U)—impact isolated to confidentiality of the local system; Confidentiality High (C:H)—arbitrary file read is possible; Integrity None (I:N)—files are not modified; Availability None (A:N)—service is not disrupted. The score reflects a meaningful information disclosure risk in local/collaborative environments without remote exploitability or system-level impact.

Frequently asked questions