CVE-2026-61431
PraisonAI before 4.6.78 Path Traversal via ContextGatherer
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
0th
PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.
| CWE | CWE-22 |
| Vendor | mervinpraison |
| Product | praisonai |
| Published | Jul 10, 2026 |
| Last Updated | Jul 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for mervinpraison praisonai
Be the first to know when new medium vulnerabilities affecting mervinpraison praisonai are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
MervinPraison / PraisonAI
0 < 4.6.78
References
github.com: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q7m5-3jmv-vm48 github.com: https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0 vulncheck.com: https://www.vulncheck.com/advisories/praisonai-before-path-traversal-via-contextgatherer
Credits
🔍 rexpository