Directory Traversal Vulnerability in PraisonAI by Mervin Praison
CVE-2026-56833

7.5HIGH

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Vendor
CVE Published:
23 October 2026

What is CVE-2026-56833?

The Dynamic Context module of PraisonAI versions 3.8.1 through 4.6.58 is susceptible to a directory traversal vulnerability. This allows lower-trust users to access sensitive .jsonl and .log files outside the intended base directory by manipulating the run_id and agent_id parameters. The issue arises from insufficient validation of these parameters, enabling unauthorized read access to filesystem paths. Users are strongly advised to upgrade to version 4.6.59 where this vulnerability has been successfully patched.

Affected Version(s)

PraisonAI >= 3.8.1, < 4.6.59

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.