CVE-2026-39305 — AI Deep Analysis Summary

🚨 **Essence**: Path Traversal in PraisonAI's Action Orchestrator. <br>💥 **Consequences**: Attackers can write files **outside** the configured workspace directory.…

🛡️ **Root Cause**: **CWE-22** (Path Traversal).…

👥 **Affected**: **PraisonAI** by **Mervin Praison**. <br>📦 **Version**: All versions **prior to 1.5.113**. <br>⚠️ **Note**: If you are running 1.5.113 or later, you are safe.

🕵️ **Attacker Actions**: <br>1. **Write Arbitrary Files**: Place malicious scripts or configs anywhere on the filesystem. <br>2. **System Compromise**: Overwrite critical system files or application configs. <br>3.…

🔓 **Exploitation Threshold**: **Low**. <br>🔑 **Auth**: **PR:N** (No Privileges Required). <br>🖱️ **UI**: **UI:N** (No User Interaction). <br>🌐 **Access**: **AV:L** (Local Access).…

📜 **Public Exploit**: **No**. <br>🚫 **PoCs**: The `pocs` field is empty. <br>📉 **Risk**: While no public PoC exists yet, the low complexity (AC:L) makes it highly susceptible to rapid weaponization by threat actors.

🔍 **Self-Check**: <br>1. Check your PraisonAI version (`pip show praisonai`). <br>2. Look for `Action Orchestrator` usage in your workflows. <br>3.…

🩹 **Official Fix**: **Yes**. <br>📦 **Patch**: Upgrade to **PraisonAI v1.5.113** or newer.…

🚧 **No Patch Workaround**: <br>1. **Isolate**: Run PraisonAI in a restricted container or sandbox with limited filesystem permissions. <br>2.…

⚡ **Urgency**: **HIGH**. <br>🔥 **Priority**: Patch immediately. <br>📊 **Reason**: CVSS Score indicates **High Impact** (I:H, A:H) with **Low Complexity**.…