CVE-2026-40157

Katalog CVE

CVSS 8.8 · High EPSS 0,53%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada praisonai. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

PraisonAI is a multi-agent teams system. Prior to 4.5.128, cmd_unpack in the recipe CLI extracts .praison tar archives using raw tar.extract() without validating archive member paths. A .praison bundle containing ../../ entries will write files outside the intended output directory. An attacker who distributes a malicious bundle can overwrite arbitrary files on the victim's filesystem when they run praisonai recipe unpack. This vulnerability is fixed in 4.5.128.

Rincian

Terbit di NVD

10 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-99g3-w8gr-x37c exploit · advisory vendor