Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI has a Path Traversal in FileTools
Vulnerability Description
PraisonAI is a multi-agent teams system. Prior to 1.5.113, _validate_path() calls os.path.normpath() first, which collapses .. sequences, then checks for '..' in normalized. Since .. is already collapsed, the check always passes. This makes the check completely useless and allows trivial path traversal to any file on the system. This vulnerability is fixed in 1.5.113.
CVSS Information
N/A
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Vulnerability Title
PraisonAI 路径遍历漏洞
Vulnerability Description
PraisonAI是Mervin Praison个人开发者的一个低代码多智能体协作框架。 PraisonAI 1.5.113之前版本存在路径遍历漏洞，该漏洞源于_validate_path函数先调用os.path.normpath折叠..序列，然后检查规范化路径中是否包含..，导致检查始终通过，可能导致简单的路径遍历到系统上的任何文件。
CVSS Information
N/A
Vulnerability Type
N/A