CVE-2026-39308 PraisonAI recipe registry publish path traversal allows out-of-root file write
A malicious publisher can write files outside the registry root via path traversal in the recipe publish endpoint, affecting PraisonAI deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-39308?
CVE-2026-39308 is a high-severity path traversal vulnerability in MervinPraison PraisonAI, published on 7 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe registry publish endpoint writes uploaded recipe bundles to a filesystem path derived from the bundle's internal manifest.json before it verifies that the manifest name and version match the HTTP route. A malicious publisher can place ../ traversal sequences in the bundle manifest and cause the registry server to create files outside the configured registry root even though the request is ultimately rejected with HTTP 400. This is an arbitrary file write / path traversal issue on the registry host. It affects deployments that expose the recipe registry publish flow. If the registry is intentionally run without a token, any network client that can reach the service can trigger it. If a token is configured, any user with publish access can still exploit it. This vulnerability is fixed in 1.5.113.
Weakness: CWE-22
Which versions are affected by CVE-2026-39308?
3 open source packages ship an affected version, including praisonai and PraisonAI. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
praisonai PyPI | All versions | 4.5.113 |
praisonai PyPI | All versions | 4.5.113 |
PraisonAI PyPI | All versions | 4.5.113 |
Products include Praison Praisonai.
How do I fix CVE-2026-39308?
Upgrade praisonai to 4.5.113 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-39308 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39308 exists.
Other vulnerabilities in MervinPraison PraisonAI
- CVE-2026-39888 PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
- CVE-2026-41497 Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI
- CVE-2026-40288 PraisonAI: Critical RCE via `type: job` workflow YAML
- CVE-2026-39890 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading
- CVE-2026-34934 PraisonAI: Second-Order SQL Injection in `get_all_user_threads`
Sources
Also known as GHSA-r9x3-wx45-2v7f, PYSEC-2026-2922.