CVE-2026-39305: Praisonai: dizin geçişi

Açıklama (NVD)

PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker (or compromised agent) to write to arbitrary files outside of the configured workspace directory. By supplying relative path segments (../) in the target path, malicious actions can overwrite sensitive system files or drop executable payloads on the host. This vulnerability is fixed in 1.5.113.

Özet bilgiler

Ürün

Praison Praisonai

CVSS v3.1

10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

EPSS

%0,32 (yüzdelik 25)

CWE

CWE-22

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• github.com
• CWE-22