CVE-2026-61432: PraisonAI Path Traversal in FastContext File Access

Technical summary

CVE-2026-61432 is a path traversal vulnerability in praisonaiagents' FastContext module (praisonaiagents.context.fast). The FastContextAgent.execute_tool() method applies workspace path containment checks only to relative paths. It fails to reject absolute paths and does not canonicalize joined paths before enforcement, allowing bypass via absolute path injection or '../' sequences. Affected tools include grep_search, glob_search, read_file, and list_directory. Successful exploitation returns file contents to the caller or injects them into the model's tool-result context, enabling information disclosure beyond the workspace boundary.

Business impact

Organizations deploying PraisonAI as part of AI agent workflows risk unauthorized exposure of sensitive files on the host system. If the application runs with elevated privileges or in environments where sensitive configuration files, credentials, or customer data reside alongside the workspace directory, an attacker could exfiltrate that information. The vulnerability is particularly concerning in multi-tenant or shared-server deployments where workspace isolation is a security boundary.

Affected systems

PraisonAI (praisonaiagents) versions prior to 1.6.78 are affected. The vulnerability is specific to deployments that use the FastContext feature. Organizations running version 1.6.78 or later are not vulnerable to this path traversal flaw.

Exploitability

The vulnerability requires authentication (PR:L in the CVSS vector) and user interaction (UI:R), placing it in the MEDIUM severity category. An authenticated user or an AI model following attacker-crafted tool arguments can trigger the vulnerability. The barrier to exploitation is low—attackers need only supply an absolute path or '../' sequence as a parameter to a vulnerable tool function. No special network capabilities or race conditions are required.

Remediation

Upgrade praisonaiagents to version 1.6.78 or later. The patch addresses path validation by rejecting absolute paths, canonicalizing paths before containment checks, and ensuring both relative and absolute paths are properly validated against the workspace boundary. After patching, verify that the FastContext feature is re-enabled and test file operations to confirm workspace isolation is enforced.

Patch guidance

Update the praisonaiagents package to version 1.6.78 or later using your package manager (e.g., 'pip install --upgrade praisonaiagents>=1.6.78'). Review deployment configurations to ensure the workspace_path is set to a narrow, least-privilege directory containing only files the AI agent should access. Test the patched version in a staging environment, particularly the grep_search, glob_search, read_file, and list_directory functions, to confirm path containment is enforced before deploying to production.

Detection guidance

Monitor application logs for tool invocations that include absolute paths (starting with '/') or '../' sequences in arguments to FastContext file-access functions. Inspect model-generated function calls in the tool-result context for suspicious file paths. Network-based detection is limited since the attack occurs within the application; focus on application-level logging and access logs that record which files were read or enumerated. Organizations without detailed logging should enable debug-level logging for the praisonaiagents.context.fast module during the interim period before patching.

Why prioritize this

Although the CVSS score is MEDIUM (5.7), the vulnerability should be prioritized based on your environment's sensitivity. If PraisonAI runs in environments with sensitive files (secrets, private keys, customer data) outside the intended workspace, or in production systems where the application has wide file-system access, remediation should be expedited. Low-risk deployments (e.g., sandboxed environments, limited file access) can follow a standard patch cycle.

Risk score, explained

The CVSS 3.1 score of 5.7 reflects a confidentiality impact (C:H) with no integrity or availability consequences, authentication and user interaction required, and local scope. The score accurately captures the information-disclosure risk but may underweight severity in multi-tenant or sensitive-data scenarios. Organizations should assess the criticality of files accessible from the application's runtime location and adjust risk posture accordingly.

Frequently asked questions