CVE-2026-55527: PraisonAI Agents path traversal

Q: Is CVE-2026-55527 actively exploited?

No confirmed active exploitation of CVE-2026-55527 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-55527?

1) Upgrade praisonaiagents to 1.6.58 or later immediately — this is the fix commit that sanitizes user_id before constructing self.user_path. 2) If upgrading isn't immediately possible, add input validation at the application layer that rejects any user_id containing path separators, "..", or non-alphanumeric characters before it reaches PraisonAI's memory layer. 3) Run the agent process with least-privilege filesystem permissions so writes are confined to the intended memory directory (e.g., a dedicated, non-privileged service account with write access scoped only to that path). 4) Add detection/monitoring for file writes originating from the agent process that land outside the expected memory directory tree. 5) Review dependency exposure — with 58 other CVEs recorded against this package family, treat PraisonAI as a component requiring active patch-tracking, not a set-and-forget dependency.

Q: What systems are affected by CVE-2026-55527?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant agent memory systems, local/file-based memory backends.

Q: What is the CVSS score for CVE-2026-55527?

CVE-2026-55527 has a CVSS v3.1 base score of 7.1 (HIGH).

CISO Take

PraisonAI's FileMemory component fails to sanitize the user_id value before joining it into a filesystem path, so any caller able to influence that identifier can inject "../" sequences and write arbitrary JSON data anywhere the agent process has filesystem write access. This is a network-exploitable, low-complexity flaw (CVSS 7.1, AV:N/AC:L/PR:L/UI:N) requiring only low privileges and no user interaction, and the package already carries 20 downstream dependents and 58 other CVEs on record, so it has real install-base reach and a history of security debt. There's no public exploit code, no Nuclei template, and it isn't in CISA's KEV list, so this reads as disclosed-but-not-yet-weaponized rather than an active campaign — but arbitrary file write inside an agent framework is a well-worn path to persistence or code execution if the attacker can land a file somewhere the app later loads, such as a startup script, cron entry, or served directory. Patch to praisonaiagents 1.6.58 or later now, and in the interim audit every code path that lets external or user-supplied input reach the FileMemory user_id parameter, restrict the process's write scope to the intended memory directory, and monitor for JSON writes outside expected paths.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Exploitability is high: the attack requires only network access, low privileges, no user interaction, and no special AI/ML knowledge — just the ability to control or influence the user_id string passed into FileMemory. The CVSS 3.1 vector (C:N/I:H/A:L) reflects a pure integrity/availability primitive: no direct confidentiality breach, but a high-confidence arbitrary write that can corrupt application state, overwrite configuration, or degrade availability, and can escalate to code execution depending on what the attacker overwrites. Exposure is highest for multi-tenant or externally-facing deployments where user_id (or an equivalent session/tenant identifier) is derived from untrusted request data rather than generated server-side. With no EPSS data, no KEV listing, and no public PoC or scanner template, near-term mass exploitation is unlikely, but the low bar to weaponize (a single crafted string) means opportunistic exploitation could appear quickly once researchers or attackers examine the diff between 1.6.57 and 1.6.58.

How does the attack unfold?

Initial access

Attacker supplies a crafted user_id containing path traversal sequences (e.g. "../") through a network-accessible interface that feeds into PraisonAI's FileMemory component.

AML.T0049

Path traversal exploitation

The unsanitized user_id is joined directly into self.user_path, letting the attacker construct a target file path outside the intended agent memory directory.

Arbitrary file write

PraisonAI writes attacker-influenced JSON memory data to the resolved path, landing content in any location the process has write permission to, potentially including configuration or scheduler directories.

AML.T0081

Impact

Depending on the overwritten target, the attacker achieves integrity compromise, service disruption (availability low per CVSS), or a foothold for follow-on code execution.

Initial access

Attacker supplies a crafted user_id containing path traversal sequences (e.g. "../") through a network-accessible interface that feeds into PraisonAI's FileMemory component.

AML.T0049

Path traversal exploitation

The unsanitized user_id is joined directly into self.user_path, letting the attacker construct a target file path outside the intended agent memory directory.

Arbitrary file write

PraisonAI writes attacker-influenced JSON memory data to the resolved path, landing content in any location the process has write permission to, potentially including configuration or scheduler directories.

AML.T0081

Impact

Depending on the overwritten target, the attacker achieves integrity compromise, service disruption (availability low per CVSS), or a foothold for follow-on code execution.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI Agents	pip	< 1.6.58	`1.6.58`
20 dependents 67% patched ~6d to patch Full package profile →

Do you use PraisonAI Agents? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A Low

What should I do?

1 step

1) Upgrade praisonaiagents to 1.6.58 or later immediately — this is the fix commit that sanitizes user_id before constructing self.user_path. 2) If upgrading isn't immediately possible, add input validation at the application layer that rejects any user_id containing path separators, "..", or non-alphanumeric characters before it reaches PraisonAI's memory layer. 3) Run the agent process with least-privilege filesystem permissions so writes are confined to the intended memory directory (e.g., a dedicated, non-privileged service account with write access scoped only to that path). 4) Add detection/monitoring for file writes originating from the agent process that land outside the expected memory directory tree. 5) Review dependency exposure — with 58 other CVEs recorded against this package family, treat PraisonAI as a component requiring active patch-tracking, not a set-and-forget dependency.

How is it classified?

Code Execution DoS Agent Framework AML.T0049 - Exploit Public-Facing Application AML.T0080.000 - Memory AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-55527?

PraisonAI's FileMemory component fails to sanitize the user_id value before joining it into a filesystem path, so any caller able to influence that identifier can inject "../" sequences and write arbitrary JSON data anywhere the agent process has filesystem write access. This is a network-exploitable, low-complexity flaw (CVSS 7.1, AV:N/AC:L/PR:L/UI:N) requiring only low privileges and no user interaction, and the package already carries 20 downstream dependents and 58 other CVEs on record, so it has real install-base reach and a history of security debt. There's no public exploit code, no Nuclei template, and it isn't in CISA's KEV list, so this reads as disclosed-but-not-yet-weaponized rather than an active campaign — but arbitrary file write inside an agent framework is a well-worn path to persistence or code execution if the attacker can land a file somewhere the app later loads, such as a startup script, cron entry, or served directory. Patch to praisonaiagents 1.6.58 or later now, and in the interim audit every code path that lets external or user-supplied input reach the FileMemory user_id parameter, restrict the process's write scope to the intended memory directory, and monitor for JSON writes outside expected paths.

Is CVE-2026-55527 actively exploited?

No confirmed active exploitation of CVE-2026-55527 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55527?

1) Upgrade praisonaiagents to 1.6.58 or later immediately — this is the fix commit that sanitizes user_id before constructing self.user_path. 2) If upgrading isn't immediately possible, add input validation at the application layer that rejects any user_id containing path separators, "..", or non-alphanumeric characters before it reaches PraisonAI's memory layer. 3) Run the agent process with least-privilege filesystem permissions so writes are confined to the intended memory directory (e.g., a dedicated, non-privileged service account with write access scoped only to that path). 4) Add detection/monitoring for file writes originating from the agent process that land outside the expected memory directory tree. 5) Review dependency exposure — with 58 other CVEs recorded against this package family, treat PraisonAI as a component requiring active patch-tracking, not a set-and-forget dependency.

What systems are affected by CVE-2026-55527?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant agent memory systems, local/file-based memory backends.

What is the CVSS score for CVE-2026-55527?

CVE-2026-55527 has a CVSS v3.1 base score of 7.1 (HIGH).

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant agent memory systemslocal/file-based memory backends

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0080.000 Memory

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller supplying ../ or path separators can escape the memory directory and write JSON data to arbitrary process-writable locations. The fix sanitizes user_id before constructing self.user_path. This issue is fixed in version 1.6.58.

Exploitation Scenario

An attacker interacts with a PraisonAI-based multi-agent product through its normal API or chat interface, where a user_id or tenant identifier is passed through from request data (e.g., a query parameter, JWT claim echoed back, or session field) into the agent's memory subsystem. Because the FileMemory constructor never sanitizes this value, the attacker supplies something like "../../../var/www/app/config" as their identifier. When the agent next persists conversation memory, PraisonAI writes attacker-controlled JSON content to that resolved path instead of the intended per-user memory file. If the traversal reaches a location the host later parses or executes — an app config file, a cron.d entry, or a served static path — the attacker converts a simple write primitive into configuration tampering, service disruption, or a foothold for code execution, all without needing credentials beyond whatever low-privilege access got them to the identifier field in the first place.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-73 External Control of File Name or Path Primary CWE-73 External Control of File Name or Path Primary

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.