CVE-2026-39308: Path Traversal in PraisonAI Recipe Registry

The vulnerability stems from insufficient validation of the manifest file's path during recipe bundle uploads. An attacker can craft a malicious recipe bundle containing a manifest file with directory traversal sequences (e.g., ../). When the PraisonAI Recipe Registry processes this bundle, it may write files to locations outside the intended registry root directory. This could allow an attacker to overwrite critical system files, potentially leading to remote code execution or denial of service. The impact is amplified if the registry server runs with elevated privileges, as this would grant the attacker broader control over the system.

1. Reserved2026-04-06
2. Published2026-04-07
3. Modified2026-04-09
4. EPSS updated2026-04-15

The primary mitigation is to upgrade PraisonAI Recipe Registry to version 1.5.113 or later, which includes the necessary validation checks. If upgrading immediately is not possible, consider implementing a Web Application Firewall (WAF) rule to block requests containing directory traversal sequences in the manifest file name. Additionally, restrict write access to the registry root directory to only authorized processes. Regularly review and audit uploaded recipe bundles for suspicious content. After upgrade, confirm the fix by attempting to upload a recipe bundle with a malicious manifest file containing directory traversal sequences; the upload should be rejected with an appropriate error.