CVE-2026-40152
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
PraisonAIAgents prior to 1.5.128 contains a vulnerability in the list_files() tool in FileTools. The pattern parameter is passed directly to Path.glob() without validation, allowing relative path traversal to enumerate arbitrary files outside the workspace and obtain file metadata.
Risk Assessment
An attacker could obtain file metadata (existence, name, size, timestamps) for any path on the filesystem, potentially aiding further attacks.
Recommendation
Upgrade PraisonAIAgents to version 1.5.128 or later. Until then, restrict access to the list_files() tool or add additional validation for the pattern parameter.
Other vulnerabilities in PraisonAIAgents
See all- CVE-2026-57123Critical
In praisonaiagents prior to 1.6.59, ToolsMCPServer.run_sse and launch_tools_mcp_server bind to 0.0.0.0 and create /sse and /messages/ routes without invoking the available SecurityConfig authentication, origin-validation, or DNS-rebinding controls. Any reachable client can list and invoke registered tools, and a browser can target a local instance through DNS rebinding.
- CVE-2026-57129High
In praisonaiagents prior to 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59.
- CVE-2026-57126High
In praisonaiagents prior to 1.6.58, SpiderTools._validate_url calls _host_is_blocked, which checks literal host encodings but does not resolve DNS names before scrape_page, crawl, extract_links, extract_text, or URL-mention fetches connect. An attacker-controlled hostname resolving to a loopback, private, link-local, or cloud-metadata address therefore bypasses the SSRF policy without a rebinding race and can expose internal responses to the agent. This issue is fixed in praisonaiagents 1.6.58.
- CVE-2026-40160Medium
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, web_crawl's httpx fallback path passes user-supplied URLs directly to httpx.AsyncClient.get() with follow_redirects=True and no host validation. An LLM agent tricked into crawling an internal URL can reach cloud metadata endpoints (169.254.169.254), internal services, and localhost, and the response content is returned to the agent and may appear in output visible to the attacker.
- CVE-2026-40117Medium
In PraisonAIAgents prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbitrary files from the filesystem via an unrestricted skill_path parameter. Unlike other functions, it enforces neither workspace boundary confinement nor critical-level approval.
Original NVD description (English source)
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he list_files() tool in FileTools validates the directory parameter against workspace boundaries via _validate_path(), but passes the pattern parameter directly to Path.glob() without any validation. Since Python's Path.glob() supports .. path segments, an attacker can use relative path traversal in the glob pattern to enumerate arbitrary files outside the workspace, obtaining file metadata (existence, name, size, timestamps) for any path on the filesystem. This vulnerability is fixed in 1.5.128.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS