Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he list_files() tool in FileTools validates the directory parameter against workspace boundaries via _validate_path(), but passes the pattern parameter directly to Path.glob() without any validation. Since Python's Path.glob() supports .. path segments, an attacker can use relative path traversal in the glob pattern to enumerate arbitrary files outside the workspace, obtaining file metadata (existence, name, size, timestamps) for any path on the filesystem. This vulnerability is fixed in 1.5.128.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40152 PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he list_files() tool in FileTools validates the directory parameter against workspace boundaries via … https://www.cve.org/CVERecord?id=CVE-2026-40152
Post summary
The text offers a brief notation of CVE-2026-40152, describing a validation issue in a tool, but provides no PoC, exploit code, patch, or detailed technical data.
CVE-2026-40152 Path Traversal in PraisonAIAgents FileTools list_files() Prior to Version 1.5.128 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40152
Post summary
The post discloses a path traversal vulnerability in PraisonAIAgents FileTools list_files() affecting versions prior to 1.5.128, with no mention of exploits, PoC, or mitigation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | praison | praisonaiagents | - | - | - |