{"uuid": "604f2d1f-a7d8-488a-8257-0d155c3e243d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61431", "type": "seen", "source": "https://gist.github.com/alon710/21e1e8eff01ed0e334b4bfcd9b5df273", "content": "# CVE-2026-61431: CVE-2026-61431: Arbitrary Local File Read and Path Traversal in PraisonAI ContextGatherer\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61431\n\n## Summary\nPraisonAI is vulnerable to an arbitrary local file read vulnerability prior to version 4.6.78. The flaw is in the ContextGatherer component, where validation checks are executed only after files are parsed and appended to the context bundle, bypassing security constraints.\n\n## TL;DR\nA check-after-use path traversal vulnerability in PraisonAI's ContextGatherer allows unauthorized reading of sensitive local host files.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22 / CWE-200\n- **Attack Vector**: Local\n- **CVSS Score**: 6.8\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: No\n- **Impact**: Information Disclosure\n\n## Affected Systems\n\n- PraisonAI\n- PraisonAIAgents\n- **praisonai**: < 4.6.78 (Fixed in: `4.6.78`)\n- **praisonaiagents**: < 4.6.78 (Fixed in: `4.6.78`)\n\n## Mitigation\n\n- Upgrade PraisonAI to version 4.6.78 or later to resolve the logic bug.\n- Manually audit .praisoncontext and .praisoninclude files within codebase workspaces before execution.\n- Containerize PraisonAI execution within restricted, non-root system environments.\n\n**Remediation Steps:**\n1. Execute 'pip install --upgrade praisonai praisonaiagents' to pull down the safe version.\n2. Verify that the active version of PraisonAI is 4.6.78 or above.\n3. Implement secure repository validation to filter untrusted user configurations in automated pipelines.\n\n## References\n\n- [GitHub Security Advisory GHSA-q7m5-3jmv-vm48](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q7m5-3jmv-vm48)\n- [Fix Commit 393de394087e3badc79acfec490323bcc99638bd](https://github.com/MervinPraison/PraisonAI/commit/393de394087e3badc79acfec490323bcc99638bd)\n- [Fix Commit 1620b49f36945d8cc8ee5635b906c960df5097a0](https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0)\n- [VulnCheck Advisory for PraisonAI Path Traversal](https://www.vulncheck.com/advisories/praisonai-before-path-traversal-via-contextgatherer)\n- [CVE-2026-61431 Record](https://www.cve.org/CVERecord?id=CVE-2026-61431)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61431) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T18:30:31.000000Z"}