CVE-2026-40152 json
PraisonAIAgents has a Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary
published 2026-04-09 7 mo ago modified 2026-10-26 13 d ago also EUVD-2026-21174 , GHSA-7j2f-xc8p-fjmq , PYSEC-2026-2944
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he list_files() tool in FileTools validates the directory parameter against workspace boundaries via _validate_path(), but passes the pattern parameter directly to Path.glob() without any validation. Since Python's Path.glob() supports .. path segments, an attacker can use relative path traversal in the glob pattern to enumerate arbitrary files outside the workspace, obtaining file metadata (existence, name, size, timestamps) for any path on the filesystem. This vulnerability is fixed in 1.5.128.
Patch / fix
- pypi praisonaiagents 1.5.128
- praison praisonaiagents 1.5.128
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7j2f-xc8p-fjmq referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | praisonaiagents | <1.5.128 |
1.5.128 |
Affected products
- MervinPraison PraisonAIAgents
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/MervinPraison/PraisonAI/security/advisories/GHSA-7j2f-xc8p-fjmq
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-40152
advisory
-
github.com
/MervinPraison/PraisonAI
package
-
pypi.org
/project/praisonaiagents
package
-
github.com
/advisories/GHSA-7j2f-xc8p-fjmq
advisory
Sources
- CVE List CVE-2026-40152
- GitHub Advisory GHSA-7j2f-xc8p-fjmq
- NVD CVE-2026-40152
- OSV PYSEC-2026-2944
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.