Vulnerability Description
PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c9
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q7m5-3jmv-vm
- https://www.vulncheck.com/advisories/praisonai-before-path-traversal-via-context
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q7m5-3jmv-vm
FAQ
What is CVE-2026-61431?
CVE-2026-61431 is a vulnerability with a CVSS score of 5.5 (MEDIUM). PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute path...
How severe is CVE-2026-61431?
CVE-2026-61431 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-61431?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.