CVE-2026-57119: PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agentfile path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files accessible to the service account, exposing credentials, keys, environment variables, and other local data. This vulnerability is fixed in 4.6.59.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PraisonAIto a version that resolves this vulnerability.Fixed in 4.6.59
Event History
Frequently Asked Questions
Which deployments are exposed?
PraisonAI deployments running a version prior to 4.6.59 are exposed if the Jobs API is reachable by remote callers. The affected endpoint is POST /api/v1/runs, and no authentication is required.
What does an attacker need to exploit this issue?
An attacker only needs network access to the unauthenticated Jobs API. They can supply an absolute path or a path containing traversal sequences through the agent_file parameter.
What data could be exposed?
The server may open files that the PraisonAI service account can access. This can expose credentials, keys, environment variables, and other local data available to that account.
What should be done if upgrading cannot happen immediately?
Restrict remote access to the Jobs API, particularly POST /api/v1/runs, until the deployment can be updated. Limiting the service account's file permissions also reduces the local data available for disclosure.
How can I remediate the vulnerability?
Upgrade PraisonAI to version 4.6.59, which fixes the missing workspace allowlist and boundary check for agent_file paths.