CVSS 3.1
7.1 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:LCVE-2026-55527
High (7.1). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in praisonaiagents 1.6.58.
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller supplying ../ or path separators can escape the memory directory and write JSON data to arbitrary process-writable locations. The fix sanitizes user_id before constructing self.user_path. This issue is fixed in version 1.6.58.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-22, CWE-73
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gxmw-5f7x-6g22 | PyPI | praisonaiagents | <1.6.58 | 1.6.58 |
| PYSEC-2026-3902 | PyPI | praisonaiagents | <1.6.58 | 1.6.58 |