CVE-2026-60088Disclosure

LOWCVSS 6.8 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can include path traversal sequences like @../outside_secret.txt or absolute paths in project command files to exfiltrate process-readable files into model prompts.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-60088 PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can incl… https://www.cve.org/CVERecord?id=CVE-2026-60088 ----- Traducción: CVE-2026-60088 Pra… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑60088, noting a file‑path validation flaw in PraisonAI that permits unauthorized file reads, but it contains no PoC, exploit code, patch, or evidence of active exploitation.
0000037
92 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-60088 PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing attackers to read files outside the workspace. Attackers can incl… https://www.cve.org/CVERecord?id=CVE-2026-60088
Post summary
A path‑validation flaw in PraisonAI versions prior to 4.6.78 is disclosed; it enables unauthorized file reads but no PoC, exploit details, or patch information are provided.
00000704
57.8K followersView on X

Explore more

Back to dashboard