CVE-2026-35615
PraisonAI has a Path Traversal in FileTools
CVSS Score
0.0
EPSS Score
0.1%
EPSS Percentile
20th
PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() calls os.path.normpath() first, which collapses .. sequences, then checks for '..' in normalized. Since .. is already collapsed, the check always passes. This makes the check completely useless and allows trivial path traversal to any file on the system. This vulnerability is fixed in 1.5.113.
| CWE | CWE-22 |
| Vendor | mervinpraison |
| Product | praisonai |
| Published | Apr 7, 2026 |
| Last Updated | Apr 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for mervinpraison praisonai
Be the first to know when new unknown vulnerabilities affecting mervinpraison praisonai are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
MervinPraison / PraisonAI
< 4.5.113