CVE-2026-56839
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_replace, and apply_diff helpers that enforce path containment only for a truthy workspace. An application that exposes code_read_file, code_search_replace, or code_apply_diff before set_workspace can therefore let prompt-influenced calls read and modify files outside the intended project directory, while explicitly configured workspaces remain effective. This vulnerability is fixed in 4.6.59.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
- EPSS probability
- 0.30%
- CWE
- CWE-22, CWE-200, CWE-863
- Published
- 2026-09-14
- Last modified
- 2026-09-14
Affected products
- MervinPraison PraisonAI
Weakness type
Related vulnerabilities
- CVE-2026-85706 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- CVE-2026-78657 — SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field
- CVE-2026-61560 — @zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover
- CVE-2026-54617 — GravitLauncher: Unauthenticated path traversal in LaunchServer FileServerHandler
- CVE-2026-45140 — Chamilo LMS CStudio upload flow allows unauthenticated remote code execution
- CVE-2026-82100 — DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
- CVE-2026-54053 — Many Notes: Path Traversal via ZIP import allows arbitrary file write and stored XSS in other users' vaults
- CVE-2026-85661 — excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode