CVE-2026-55540: PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

Summary PraisonAI's praisonai.code tool wrappers (exported as CODETOOLS for agents) expose a workspace setting that the module itself treats as a path-traversal security boundary — readfile, writefile, applydiff, and searchreplace explicitly call ispathwithindirectory() and return "… is outside the workspace" on violations. That boundary is enforced unsoundly and inconsistently: 1. The containment helper uses os.path.abspath(), not realpath()/Path.resolve(). A symlink located inside the workspace whose target is outside has an abspath() that is still inside the workspace, so it passes the check while open() follows the link. This bypasses read, write, applydiff, and searchreplace (CWE-59). 2. listfiles() resolves path against the workspace but never calls the containment helper at all — ../ and absolute paths escape directly (CWE-22). 3. executecommand() takes a workspace argument documented "for security validation" but performs no cwd containment check; codeexecutecommand() resolves a relative cwd against the workspace and also never validates it (and never even passes workspace to the low-level helper). A relative cwd="../outside" runs commands from outside the workspace (CWE-22). An attacker who can influence an agent that has these tools attached (untrusted prompt, indirect prompt injection, or a server-exposed agent) can read, overwrite, list, and execute from outside the configured workspace, bounded only by the process user's filesystem permissions.

Technical Detail 1. Unsound containment helper (symlink bypass — CWE-59) python src/praisonai/praisonai/code/utils/fileutils.py — ispathwithindirectory() absfile = os.path.abspath(filepath) # does NOT resolve symlinks absdir = os.path.abspath(directory) if not absdir.endswith(os.sep): absdir += os.sep return absfile.startswith(absdir) or absfile == absdir.rstrip(os.sep) readfile/writefile/applydiff/searchreplace call this with the configured workspace (e.g. readfile.py: # Security check - ensure path is within workspace). Because abspath() does not canonicalize symlinks, a link at WORKSPACE/linktosecret.txt → /outside/secret.txt has abspath WORKSPACE/linktosecret.txt (inside) and passes, while open() follows it to the real outside target. 2. listfiles() has no containment check (CWE-22) python src/praisonai/praisonai/code/tools/listfiles.py if workspace and not os.path.isabs(path): abspath = os.path.abspath(os.path.join(workspace, path)) # ../ collapses out of workspace else: abspath = os.path.abspath(path) # absolute path used as-is ... os.path.isdir(abspath) then listed. ispathwithindirectory() is NEVER called. 3. executecommand() never validates cwd (CWE-22) python src/praisonai/praisonai/code/tools/executecommand.py — workspace param doc: "for security validation" if cwd: if workspace and not os.path.isabs(cwd): workdir = os.path.abspath(os.path.join(workspace, cwd)) # ../ escapes; no containment check else: workdir = os.path.abspath(cwd) subprocess.run(args, cwd=workdir, ...) # no ispathwithindirectory() anywhere python src/praisonai/praisonai/code/agenttools.py — codeexecutecommand() if workdir and workspaceroot and not os.path.isabs(workdir): workdir = os.path.join(workspaceroot, workdir) # joins, never validates result = executecommand(command=command, cwd=workdir, timeout=120) # workspace not even passed Note: executecommand rejects shell=True and runs shlex.split(command) via subprocess.run (no shell), so shell metacharacters (&&, >, pipes) do not work — but any binary still runs with attacker-chosen argv from the escaped cwd, which is sufficient to read/write outside the workspace. The workspace is an intended boundary (pre-empts "by design") The module asserts this control itself: readfile.py "Security check - ensure path is within workspace"; writefile.py "default workspace is cwd so relative paths cannot escape"; ispathwithindirectory docstring "(prevents path traversal)"; executecommand workspace param "for security validation". The bug is that the asserted control is unsound (abspath vs realpath) and not applied to listfiles/executecommand cwd.

Proof of Concept Self-contained, local temp fixtures only; no network, no untrusted commands. Real praisonai.code agent tools were called. workspace = /tmp/.../workspace outside = /tmp/.../outside [1] baseline plain ../ read -> BLOCKED: "Path '../outside/secret.txt' is outside the workspace" [2] symlink read (in-WS link) -> SUCCESS: returned "SECRETOUTSIDEWORKSPACE" [3] symlink write (in-WS link) -> SUCCESS: outside file now contains "OVERWRITTENVIASYMLINK" [4] codelistfiles("../outside") -> SUCCESS: "Contents of ../outside: 📄 secret.txt" [5] codeexecutecommand(cwd="../outside","pwd") -> SUCCESS: stdout "/tmp/.../outside" [6] codeexecutecommand(cwd="../outside", python3 -c open('planted.txt','w')...) -> SUCCESS: new file created OUTSIDE workspace, "PWNEDOUTSIDEWORKSPACE" Steps 2–6 each cross the configured workspace boundary; step 1 shows the plain-../ guard that the symlink and unscoped vectors bypass. Impact - Confidentiality: read files outside the workspace (in-workspace symlink; or list/enumerate outside dirs via listfiles). - Integrity: overwrite outside files via symlink; create/modify files outside the workspace via executecommand running in an escaped cwd. - Execution boundary: run arbitrary available binaries (argv-controlled) from a directory outside the workspace. Bounded by the process user's permissions. In a code-agent or server-exposed agent processing untrusted input, this exposes secrets / project-adjacent / host files and breaks the project-boundary integrity guarantee the workspace setting advertises.

Suggested Fix - Replace ispathwithindirectory() with a realpath() / Path.resolve()-based containment check, and compare with os.path.commonpath() rather than startswith. - Apply that check consistently to every file path, directory path, backup path, diff/search-replace target, and command working directory, after full canonicalization (resolve the symlink's real target, not the link path). - listfiles(): reject absolute paths and ../ escapes when workspace is set. - executecommand(): validate cwd containment when workspace is set; codeexecutecommand() should pass workspaceroot to the low-level helper or validate itself. - Regression tests: symlink read/write/diff/search-replace to outside targets; listfiles("../outside", workspace=…); executecommand(cwd="../outside", workspace=…); absolute outside paths with a workspace set.