PraisonAI has a Path Traversal in FileTools

PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() calls os.path.normpath() first, which collapses .. sequences, then checks for '..' in normalized. Since .. is already collapsed, the check always passes. This makes the check completely useless and allows trivial path traversal to any file on the system. This vulnerability is fixed in 1.5.113.

N/A

对路径名的限制不恰当(路径遍历)

PraisonAI 路径遍历漏洞

PraisonAI是Mervin Praison个人开发者的一个低代码多智能体协作框架。 PraisonAI 1.5.113之前版本存在路径遍历漏洞，该漏洞源于_validate_path函数先调用os.path.normpath折叠..序列，然后检查规范化路径中是否包含..，导致检查始终通过，可能导致简单的路径遍历到系统上的任何文件。

N/A

N/A