CVE-2026-35615CWE-22

PraisonAI has a Path Traversal in FileTools

Critical · published April 7, 2026

CVSS v4.0
9.2
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() calls os.path.normpath() first, which collapses .. sequences, then checks for '..' in normalized. Since .. is already collapsed, the check always passes. This makes the check completely useless and allows trivial path traversal to any file on the system. This vulnerability is fixed in 1.5.113.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00540 · 44.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-04-07T16:46Z
EPSS history
Timeline
  • 07 APR 16:46Z
    PraisonAI has a Path Traversal in FileTools
    cvelistv5