PraisonAI recipe registry pull path traversal schreibt Dateien außerhalb des gewählten Ausgabeverzeichnisses

This vulnerability allows an attacker to upload a specially crafted recipe bundle containing ../ sequences within the tar archive. When a user pulls this recipe, the tar.extractall() function will extract files outside the designated output directory, potentially overwriting critical system files or injecting malicious code. The impact is client-side, meaning the attacker needs to convince a user to pull a malicious recipe. The blast radius is limited to the user's system, but the potential for damage is significant, ranging from data corruption to complete system compromise. This is similar to other path traversal vulnerabilities where attackers can leverage the lack of input validation to gain unauthorized access and write capabilities.

Organizations utilizing PraisonAI for recipe management, particularly those relying on user-uploaded recipes, are at risk. Shared hosting environments where multiple users can upload recipes pose a heightened risk, as a malicious recipe could impact other users on the same server. Users with legacy PraisonAI configurations or those who haven't implemented robust input validation practices are also more vulnerable.

• python / server:

import os
import tarfile

def check_tar_archive(archive_path):
    try:
        with tarfile.open(archive_path, 'r') as tar:
            for member in tar.getmembers():
                if '..' in member.name:
                    print(f"Potential path traversal detected in: {member.name}")
                    return True
        return False
    except Exception as e:
        print(f"Error processing archive: {e}")
        return False

# Example usage
archive_path = '/path/to/your/archive.praison'
if check_tar_archive(archive_path):
    print("Malicious archive detected!")
else:
    print("Archive appears safe.")

• generic web: Check for unusual file modifications in the recipe pull output directory. Monitor user activity for suspicious file creation or modification patterns.

1. 2026-04-06Disclosure

   disclosure

1. Reserviert2026-04-06
2. Veröffentlicht2026-04-06
3. Geändert2026-04-07
4. EPSS aktualisiert2026-04-15

The primary mitigation is to upgrade PraisonAI to version 4.5.113 or later, which includes the necessary input validation to prevent path traversal. If upgrading is not immediately feasible, consider restricting the sources from which users can pull recipes to trusted locations only. Implement strict file access controls on the output directory to limit the potential damage from a successful attack. Monitor system logs for unusual file creation or modification activity in unexpected locations. While a WAF is unlikely to directly address this client-side vulnerability, it can help detect and block suspicious recipe bundles based on known malicious patterns.