{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/praisonaiagents/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-55527"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["praisonaiagents"],"_cs_severities":["high"],"_cs_tags":["vulnerability","path-traversal","python","ssrf","praisonaiagents","cloud-security","authentication-bypass","insecure-design","api-security"],"_cs_type":"advisory","_cs_vendors":["PraisonAI"],"content_html":"\u003cp\u003ePraisonAI Agents (up to version 1.6.52) contains a critical path traversal vulnerability within the \u003ccode\u003eFileMemory\u003c/code\u003e component, located in \u003ccode\u003epraisonaiagents/memory/file_memory.py\u003c/code\u003e. The \u003ccode\u003e__init__\u003c/code\u003e method accepts a \u003ccode\u003euser_id\u003c/code\u003e parameter that is directly joined to a base directory without validation or normalization. An attacker able to influence this parameter - through direct API calls, agent configurations, or submitted job manifests - can inject path traversal sequences such as \u003ccode\u003e../\u003c/code\u003e. This allows the application to write files to arbitrary locations on the host filesystem that the process has permissions to access. The vulnerability persists in the \u003ccode\u003emain\u003c/code\u003e branch and is distinct from previously reported issues, posing a significant risk for file manipulation, system configuration corruption, or denial-of-service attacks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious input containing a traversal payload (e.g., \u003ccode\u003euser_id: \u0026quot;../../etc/cron.d/malicious\u0026quot;\u003c/code\u003e) within an agent job submission.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eagents_generator.py\u003c/code\u003e service parses the user-submitted \u003ccode\u003eagent_yaml\u003c/code\u003e and extracts the memory configuration.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eAgent\u003c/code\u003e constructor is invoked, passing the attacker-controlled \u003ccode\u003euser_id\u003c/code\u003e to the \u003ccode\u003eFileMemory\u003c/code\u003e class.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eFileMemory.__init__\u003c/code\u003e method concatenates the malicious \u003ccode\u003euser_id\u003c/code\u003e with the \u003ccode\u003ebase_path\u003c/code\u003e using Python's \u003ccode\u003epathlib\u003c/code\u003e join operator.\u003c/li\u003e\n\u003cli\u003eThe application calls \u003ccode\u003emkdir\u003c/code\u003e on the constructed path, creating the directory structure on the filesystem if it does not exist.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eFileMemory\u003c/code\u003e instance performs file operations (e.g., \u003ccode\u003eadd_short_term\u003c/code\u003e), resulting in the creation of JSON files (e.g., \u003ccode\u003eshort_term.json\u003c/code\u003e) at the attacker-specified target location.\u003c/li\u003e\n\u003cli\u003eSuccessful execution results in unauthorized file writes, potentially allowing an attacker to overwrite sensitive system configurations or package files.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to perform arbitrary file writes on the host system running the PraisonAI service. Impacts include Denial of Service by disk filling, overwriting critical application configuration files to alter runtime behavior, or attempting to leverage the file write to achieve persistence or code execution by overwriting startup scripts, cron tasks, or system files if the service process runs with sufficient privileges. This is particularly critical in multi-tenant environments where one user could overwrite the memory data or configurations belonging to another user.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003epraisonaiagents\u003c/code\u003e to version 1.6.58 or later to incorporate necessary sanitization patches.\u003c/li\u003e\n\u003cli\u003eImplement strict input validation on \u003ccode\u003euser_id\u003c/code\u003e parameters in any application code interacting with \u003ccode\u003eFileMemory\u003c/code\u003e to ensure they only contain alphanumeric characters, underscores, and hyphens.\u003c/li\u003e\n\u003cli\u003eApply the principle of least privilege to the service account executing PraisonAI agents to minimize the impact of arbitrary file writes on system-level directories.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, implement a proxy or validation layer to scan \u003ccode\u003eagent_yaml\u003c/code\u003e inputs for directory traversal patterns before processing.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-25T16:03:20Z","date_published":"2026-08-25T16:02:43Z","id":"https://feed.craftedsignal.io/briefs/2026-08-praisonaiagents-path-traversal/","summary":"The FileMemory component in praisonaiagents versions 1.6.52 and earlier fails to sanitize user-supplied identifiers, enabling path traversal attacks that result in arbitrary JSON file creation or overwriting.","title":"Arbitrary File Write Vulnerability in PraisonAI Agents","url":"https://feed.craftedsignal.io/briefs/2026-08-praisonaiagents-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Praisonaiagents","version":"https://jsonfeed.org/version/1.1"}