CVE-2026-39305Patch(praison / praisonai)

LOWCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch praison praisonai systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker (or compromised agent) to write to arbitrary files outside of the configured workspace directory. By supplying relative path segments (../) in the target path, malicious actions can overwrite sensitive system files or drop executable payloads on the host. This vulnerability is fixed in 1.5.113.

praison CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Exploit / PoC references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

praisonai

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
Disclousure: 1 classified signal
Peaked 1d ago at 3 mentions (2026-04-07); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

praison

Products

praisonai

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Patch

250.0%

Disclosure

125.0%

Disclousure

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-07	3	Disclosure1Disclousure1Patch1
2026-04-09	1	Patch1

Full discourse4 posts

0day Signal@0dayPublishing184d
Disclousure
🚨 CVE-2026-39305: Arbitrary File Write / Path Trav... AI agent frameworks with path traversal bugs are basically giving attackers root access with extra steps - compromised ... https://zerodaysignal.com/vulnerability/CVE-2026-39305 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces CVE‑2026‑39305, noting an arbitrary file write/path traversal flaw in AI agent frameworks that could grant root access, but it only points to a vulnerability page without providing exploit code, patches, or evidence of active exploitation.
0001164
204 followersView on X
PulsePatch.io@pulsepatchio183d
Patch
A critical arbitrary file write and path traversal vulnerability (CVE-2026-39305) impacts `PraisonAI`. Attackers could exploit this to compromise systems. Patching is recommended when available. #PraisonAI #Cybersecurity #AppSec https://www.pulsepatch.io/posts/cve-2026-39305-praisonai-arbitrary-file-write-path-traversal
Post summary
The post announces a critical arbitrary file write and path traversal flaw in PraisonAI (CVE-2026-39305) and advises applying patches when available, without mentioning any PoC or active exploitation.
0000048
11 followersView on X
CVEFind.com@CveFindCom184d
Patch
[CVE-2026-39305: CRITICAL] Beware of a Path Traversal vulnerability in PraisonAI pre-1.5.113! Attackers can exploit it to write files outside the workspace. Update to 1.5.113 to stay protected.#cve,CVE-2026-39305,#cybersecurity https://cvefind.com/CVE-2026-39305
Post summary
The note alerts of a path traversal flaw in PraisonAI versions before 1.5.113 that could let attackers write files outside the workspace, and urges users to upgrade to 1.5.113.
0000035
619 followersView on X
CVE@CVEnew184d
Disclosure
CVE-2026-39305 PraisonAI is a multi-agent teams system. Prior to 1.5.113, the Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker (or comprom… https://www.cve.org/CVERecord?id=CVE-2026-39305
Post summary
The message discloses that PraisonAI's Action Orchestrator has a path traversal flaw present before version 1.5.113, but provides no PoC, exploit, or patch information.
00000116
57.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	praison	praisonai	-	-	-

Explore more

Back to dashboard praison CVEs praisonai vulnerabilities

What researchers are saying

CVE-2026-39305

0day Signal@0dayPublishingDisclousure

The tweet announces CVE‑2026‑39305, noting an arbitrary file write/path traversal flaw in AI agent frameworks that could grant root access, but it only points to a vulnerability page without providing exploit code, patches, or evidence of active exploitation.

PulsePatch.io@pulsepatchioPatch

The post announces a critical arbitrary file write and path traversal flaw in PraisonAI (CVE-2026-39305) and advises applying patches when available, without mentioning any PoC or active exploitation.

CVEFind.com@CveFindComPatch

The note alerts of a path traversal flaw in PraisonAI versions before 1.5.113 that could let attackers write files outside the workspace, and urges users to upgrade to 1.5.113.

CVE@CVEnewDisclosure

The message discloses that PraisonAI's Action Orchestrator has a path traversal flaw present before version 1.5.113, but provides no PoC, exploit, or patch information.