CVE-2026-40152 PraisonAIAgents has a Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary
Attackers can enumerate arbitrary files outside the workspace by exploiting unvalidated glob patterns in the list_files tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40152?
CVE-2026-40152 is a medium-severity path traversal vulnerability in MervinPraison PraisonAIAgents, published on 9 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he list_files() tool in FileTools validates the directory parameter against workspace boundaries via _validate_path(), but passes the pattern parameter directly to Path.glob() without any validation. Since Python's Path.glob() supports .. path segments, an attacker can use relative path traversal in the glob pattern to enumerate arbitrary files outside the workspace, obtaining file metadata (existence, name, size, timestamps) for any path on the filesystem. This vulnerability is fixed in 1.5.128.
Weakness: CWE-22
Which versions are affected by CVE-2026-40152?
3 open source packages ship an affected version, including praisonaiagents. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
praisonaiagents PyPI | All versions | 1.5.128 |
praisonaiagents PyPI | All versions | 1.5.128 |
praisonaiagents PyPI | All versions | 1.5.128 |
Products include Praison Praisonaiagents.
How do I fix CVE-2026-40152?
Upgrade praisonaiagents to 1.5.128 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-40152 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40152 exists.
Other vulnerabilities in MervinPraison PraisonAIAgents
- CVE-2026-34938 PraisonAI: Python Sandbox Escape via str Subclass startswith() Override in execute_code
- CVE-2026-40111 PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor (memory/hooks.py)
- CVE-2026-34954 PraisonAI: SSRF in FileTools.download_file() via Unvalidated URL
- CVE-2026-34937 PraisonAI: Shell Injection in run_python() via Unescaped $() Substitution
- CVE-2026-44335 SSRF bypass in PraisonAI
Sources
Also known as GHSA-7j2f-xc8p-fjmq, PYSEC-2026-2944.