PraisonAI betroffen durch beliebige Dateischreibung mittels Pfadübersprung in `praisonai recipe unpack`

The impact of this vulnerability is severe. An attacker who can successfully distribute and unpack a malicious .praison bundle gains the ability to overwrite any file on the victim's filesystem. This could lead to complete system compromise, including the modification or deletion of critical configuration files, installation of malware, or exfiltration of sensitive data. The ability to write arbitrary files represents a significant escalation of privileges and a substantial security risk. This vulnerability shares similarities with other archive-based path traversal exploits where insufficient validation of archive contents allows for unauthorized file system access.

Organizations utilizing PraisonAI for multi-agent team systems, particularly those deploying it in environments with untrusted input or where .praison bundles are sourced from external or unknown origins, are at significant risk. Shared hosting environments where multiple users share the same server instance are also vulnerable, as a malicious bundle uploaded by one user could impact other users.

• linux / server:

find /opt/praisonai/ -name '*.praison' -print0 | xargs -0 grep -l '\.\.\\/'

• python / supply-chain:

import os
import tarfile

def check_praison_bundle(bundle_path):
    try:
        with tarfile.open(bundle_path, 'r') as tar:
            for member in tar.getmembers():
                if '..' in member.name:
                    print(f"Potential Path Traversal detected in {bundle_path}")
                    return True
        return False
    except Exception as e:
        print(f"Error processing {bundle_path}: {e}")
        return False

# Example usage (replace with actual bundle paths)
# check_praison_bundle('/path/to/malicious.praison')

• generic web:

curl -I 'http://your-praisonai-server/recipe/unpack?bundle=../../../../etc/passwd' # Check for unexpected responses

1. 2026-04-10Disclosure

   disclosure

1. Reserviert2026-04-09
2. Veröffentlicht2026-04-10
3. Geändert2026-04-14
4. EPSS aktualisiert2026-04-18

The primary mitigation for CVE-2026-40157 is to upgrade PraisonAI to version 4.5.128 or later. If upgrading is not immediately feasible, consider implementing strict file system access controls to limit the impact of a successful exploit. This could involve restricting write access to the directory where .praison bundles are unpacked. Additionally, carefully scrutinize the source of any .praison bundles before unpacking them. There are no known WAF rules or specific detection signatures for this vulnerability, so proactive source validation is crucial. After upgrading, verify the fix by attempting to unpack a known malicious .praison bundle (in a controlled environment) and confirming that the attempt fails with an appropriate error.