Vulnerability · Published Jul 10, 2026 · Assigned by VulnCheck

CVE-2026-61431PraisonAI before 4.6.78 Path Traversal via ContextGatherer

Medium 5.5

In plain English

A medium-severity path traversal in PraisonAI from MervinPraison. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.4%top 68.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	praisonai	4.6.78	GHSA-q7m5-3jmv-vm48
PyPI	praisonai	4.6.78	PYSEC-2026-4258

Affected products (as reported)

Vendor	Product	Versions
MervinPraison	PraisonAI	0 – before 4.6.78

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-q7m5-3jmv-vm48) vendor-advisory
https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0 patch
VulnCheck Advisory: PraisonAI before 4.6.78 Path Traversal via ContextGatherer third-party-advisory