CVE-2026-56078

HIGH

PraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitor

Title source: cna
STIX 2.1

Description

PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs when building file paths. Attackers can include traversal sequences like ../ in agent IDs to read, write, or overwrite arbitrary files, enabling sensitive disclosure, denial of service, or code execution.

References (3)

Core 3
Core References
Third Party Advisory third-party-advisory
VulnCheck Advisory: PraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitor
https://www.vulncheck.com/advisories/praisonai-arbitrary-file-read-and-write-via-path-traversal-in-multiagentmonitor

Scores

CVSS v3 8.8
EPSS 0.0069
EPSS Percentile 48.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-22
Status published
Products (3)
PraisonAI/PraisonAI < 1.5.115
PraisonAI/PraisonAI 1.5.115
pypi/praisonaiagents 0 - 1.5.115PyPI
Published Jun 18, 2026
Tracked Since Jun 19, 2026