CVE-2026-44340 PraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
Attackers can write arbitrary files outside the intended directory via symlink extraction bypass in PraisonAI, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44340?
CVE-2026-44340 is a high-severity path traversal vulnerability in MervinPraison PraisonAI, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member's name for absolute paths, .. segments, and resolved-path escape — but does not validate member.linkname, does not reject symlink/hardlink members, and calls tar.extractall(dest_dir) without filter="data". A bundle that contains a symlink with a name inside dest_dir but a linkname pointing outside it, followed by a regular file whose path traverses through the just-created symlink, escapes dest_dir and lets the attacker write arbitrary content to an attacker-chosen location on the victim's filesystem. This issue has been patched in version 4.6.37.
Which versions are affected by CVE-2026-44340?
3 open source packages ship an affected version, including praisonai and PraisonAI. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
praisonai PyPI | All versions | 4.6.37 |
praisonai PyPI | All versions | 4.6.37 |
PraisonAI PyPI | All versions | 4.6.37 |
Products include Praison Praisonai.
How do I fix CVE-2026-44340?
Upgrade praisonai to 4.6.37 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-44340 being exploited?
There is no known exploitation of CVE-2026-44340 in the wild and no public exploit code.
Other vulnerabilities in MervinPraison PraisonAI
- CVE-2026-39888 PraisonAIAgents has a sandbox escape via exception frame traversal in `execute_code` (subprocess mode)
- CVE-2026-41497 Incomplete fix for CVE-2026-34935: Command Injection in MervinPraison/PraisonAI
- CVE-2026-40288 PraisonAI: Critical RCE via `type: job` workflow YAML
- CVE-2026-39890 PraisonAI Affected by Remote Code Execution via YAML Deserialization in Agent Definition Loading
- CVE-2026-34934 PraisonAI: Second-Order SQL Injection in `get_all_user_threads`
Sources
Also known as GHSA-9q28-ghcr-c4x3, PYSEC-2026-2909.