Directory Traversal Vulnerability in PraisonAI by Mervin Praison
CVE-2026-57113

8.1HIGH

Key Information:

Vendor

Mervinpraison

Status
Praisonai
Vendor
CVE Published:
23 October 2026

What is CVE-2026-57113?

PraisonAI, a multi-agent teams system, has a directory traversal vulnerability due to its template loader processing GitHub template URIs without proper validation. This oversight allows attackers to craft malicious references that escape the intended cache directory. When a crafted reference is used, it can manipulate file paths to delete files outside of the expected cache location. This issue is particularly concerning as it can lead to unauthorized data deletion. The vulnerability has been addressed in version 4.6.59, underscoring the importance of updating to secure your installations.

Affected Version(s)

PraisonAI >= 2.6.0, < 4.6.59

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.