CVE-2026-56833: PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept runid and agentid arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because runid can be an absolute path and agentid can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using PraisonAI versions 3.8.1 through before 4.6.59 are exposed if lower-trust prompts or users can invoke the Dynamic Context agent-callable history or terminal-log tools.
What does an attacker need to exploit it?
An attacker needs the ability to call the affected tools and supply run_id or agent_id values. No authentication privileges or user interaction are required according to the provided vector, but the attacker must have access to those tool calls.
What data could be read?
The issue can expose .jsonl history files and .log terminal-log files outside the configured Dynamic Context base directory. It is an information disclosure issue; the provided data does not indicate file modification or service disruption.
How can this be remediated?
Upgrade PraisonAI to version 4.6.59, which patches the issue. If an upgrade cannot be applied immediately, restrict lower-trust prompts and users from calling the Dynamic Context history and terminal-log tool factories.
How can I determine whether my deployment is affected?
Check whether the installed PraisonAI version is 3.8.1 or later but earlier than 4.6.59, and whether Dynamic Context filesystem-backed history or terminal-log tools are exposed to callers that can control run_id or agent_id.