{"vulnerability": "CVE-2026-61431", "sightings": [{"uuid": "61fb2881-426d-4adb-955b-c5b6cd39091a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61431", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqcmlhpqih2l", "content": "CVE-2026-61431 - PraisonAI before 4.6.78 Path Traversal via ContextGatherer\nCVE ID : CVE-2026-61431\n \n Published : July 10, 2026, 3:16 p.m. | 32\u00a0minutes ago\n \n Description : PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to valida...", "creation_timestamp": "2026-07-10T16:57:30.949792Z"}, {"uuid": "fa888263-481e-45c0-958c-1dec7b1ef35e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61431", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcxtbl45i2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-61431 \u0432 PraisonAI: \u0443\u0433\u0440\u043e\u0437\u0430 path traversal \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/AC3F488C-C94F-4ECC-BC7D-BBD5B004F7A6", "creation_timestamp": "2026-07-10T20:18:44.210073Z"}, {"uuid": "9959ba4c-9e05-4479-9fc0-f9d7bcaf8bb7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61431", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd5s4vqkc2d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-61431 \u0432 PraisonAI: \u0443\u0433\u0440\u043e\u0437\u0430 path traversal \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/2784A752-A6C0-466C-BE0E-348ACE5C04D6", "creation_timestamp": "2026-07-10T22:05:28.495767Z"}, {"uuid": "604f2d1f-a7d8-488a-8257-0d155c3e243d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61431", "type": "seen", "source": "https://gist.github.com/alon710/21e1e8eff01ed0e334b4bfcd9b5df273", "content": "# CVE-2026-61431: CVE-2026-61431: Arbitrary Local File Read and Path Traversal in PraisonAI ContextGatherer\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-10-08\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61431\n\n## Summary\nPraisonAI is vulnerable to an arbitrary local file read vulnerability prior to version 4.6.78. The flaw is in the ContextGatherer component, where validation checks are executed only after files are parsed and appended to the context bundle, bypassing security constraints.\n\n## TL;DR\nA check-after-use path traversal vulnerability in PraisonAI's ContextGatherer allows unauthorized reading of sensitive local host files.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22 / CWE-200\n- **Attack Vector**: Local\n- **CVSS Score**: 6.8\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: No\n- **Impact**: Information Disclosure\n\n## Affected Systems\n\n- PraisonAI\n- PraisonAIAgents\n- **praisonai**: < 4.6.78 (Fixed in: `4.6.78`)\n- **praisonaiagents**: < 4.6.78 (Fixed in: `4.6.78`)\n\n## Mitigation\n\n- Upgrade PraisonAI to version 4.6.78 or later to resolve the logic bug.\n- Manually audit .praisoncontext and .praisoninclude files within codebase workspaces before execution.\n- Containerize PraisonAI execution within restricted, non-root system environments.\n\n**Remediation Steps:**\n1. Execute 'pip install --upgrade praisonai praisonaiagents' to pull down the safe version.\n2. Verify that the active version of PraisonAI is 4.6.78 or above.\n3. Implement secure repository validation to filter untrusted user configurations in automated pipelines.\n\n## References\n\n- [GitHub Security Advisory GHSA-q7m5-3jmv-vm48](https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-q7m5-3jmv-vm48)\n- [Fix Commit 393de394087e3badc79acfec490323bcc99638bd](https://github.com/MervinPraison/PraisonAI/commit/393de394087e3badc79acfec490323bcc99638bd)\n- [Fix Commit 1620b49f36945d8cc8ee5635b906c960df5097a0](https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0)\n- [VulnCheck Advisory for PraisonAI Path Traversal](https://www.vulncheck.com/advisories/praisonai-before-path-traversal-via-contextgatherer)\n- [CVE-2026-61431 Record](https://www.cve.org/CVERecord?id=CVE-2026-61431)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61431) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T18:30:31.000000Z"}]}