High severity · published Sep 14, 2026
CVE-2026-57129
PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
praisonaiagents · MervinPraison
< 1.6.59 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57129
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57129
github.com
https://github.com/MervinPraison/PraisonAI/commit/b4270173d4123fb1ee8910588f0896668ee21b59
github.com
https://github.com/MervinPraison/PraisonAI/releases/tag/v4.6.59
github.com
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2rcg-mm5h-xchx
More from praisonaiagents
9.9
CVE-2026-39888
PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
9.8
CVE-2026-57118
PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints
9.8
CVE-2026-57123
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
9.8
CVE-2026-57125
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
9.8
CVE-2026-40288
PraisonAI: Critical RCE via `type: job` workflow YAML