Описание
PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.
Ссылки
EPSS
Процентиль: 18%
0.00259
Низкий
5.5 Medium
CVSS3
Дефекты
CWE-22
Связанные уязвимости
CVSS3: 5.5
github
около 1 месяца назад
PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.
EPSS
Процентиль: 18%
0.00259
Низкий
5.5 Medium
CVSS3
Дефекты
CWE-22