Directory Traversal Vulnerability in PraisonAI by Mervin Praison
CVE-2026-55540
7.1HIGH
What is CVE-2026-55540?
A directory traversal vulnerability exists in PraisonAI before version 4.6.51. The function is_path_within_directory() improperly utilizes os.path.abspath() instead of os.path.realpath(), allowing a symlink within the workspace to reference files outside of the designated directory. Consequently, this misconfiguration permits unauthorized access to files, leading to potential data breaches and integrity risks. The issue has been addressed in version 4.6.58, ensuring improved security for users.
Affected Version(s)
PraisonAI < 4.6.58