CVE-2026-39305 - Vulnerability Analysis

Overview

PraisonAI < 1.5.113 contains a path traversal caused by improper validation of relative path segments in Action Orchestrator, letting attackers or compromised agents write arbitrary files outside the workspace, exploit requires attacker control of target path.

Severity & Score

Impact

Attackers can write arbitrary files outside the workspace, potentially overwriting system files or dropping malicious payloads.

Mitigation

Update to version 1.5.113 or later.

References

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jfxc-v5g9-38xr

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner