{"schema":"threatline.record/2","record":{"id":"CVE-2026-57113","aliases":["GHSA-f44v-7qgw-9gh9","PYSEC-2026-3509"],"summary":"PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion","details":"PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.","categories":["Libraries & packages"],"product":"PraisonAI","vendor":"MervinPraison","ecosystem":"PyPI","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-57113","source_modified_at":"2026-10-23T14:59:39.455Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"PraisonAI","vendor":"MervinPraison","versions":[{"status":"affected","version":">= 2.6.0, < 4.6.59"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-f44v-7qgw-9gh9","source_modified_at":"2026-07-23T15:11:51.000001185Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"praisonai","ecosystem":"PyPI","purl":"pkg:pypi/praisonai"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"4.6.59"}]}],"versions":["2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.7.0","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.9","2.9.0","2.9.1","2.9.2","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","3.0.6","3.0.7","3.0.8","3.0.9","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.10.0","3.10.1","3.10.10","3.10.11","3.10.12","3.10.13","3.10.14","3.10.15","3.10.16","3.10.17"]}],"fixed_versions":[{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-f44v-7qgw-9gh9","source_modified_at":"2026-07-23T15:11:51.000001185Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"praisonai","ecosystem":"PyPI","purl":"pkg:pypi/praisonai"},"version":"4.6.59"}],"cvss":8.1,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T12:04:04.048Z","modified_at":"2026-10-23T14:59:39.455Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-57113","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T14:59:39.455Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-f44v-7qgw-9gh9","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-07-23T15:11:51.000001185Z"}],"sources":["CVE List","OSV"],"references":[{"source":"CVE List","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-f44v-7qgw-9gh9","tags":["x_refsource_CONFIRM"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-23T14:48:44.873305Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-23T14:59:39.455Z","content_hash":"49e9b8db3696f984542b14029eac84b856a2d97e31fb976da4dd23c72d497c4d"}}