---
id: CVE-2026-57113
title: >-
  PraisonAI GitHub template cache path traversal allows outside-cache file write
  and directory deletion
summary: >-
  PraisonAI is a multi-agent teams system. From version 2.6.0 to before version
  4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs,
  for example github:owner/repo/template@v1.0.0. The resolver stores the
  user-control…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-22
  - CWE-73
vendor: MervinPraison
product: PraisonAI
affected:
  - 'PraisonAI >= 2.6.0, < 4.6.59'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-23T14:48:44.873305Z'
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T14:59:39.455Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-57113'
references:
  - url: >-
      https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-f44v-7qgw-9gh9
    label: >-
      https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-f44v-7qgw-9gh9
  - url: 'https://github.com/MervinPraison/PraisonAI'
tags:
  - cve.org
  - osv
  - pip
aliases:
  - GHSA-f44v-7qgw-9gh9
ecosystem: pip
patched:
  - praisonai 4.6.59
ingestedAt: '2026-07-21T19:04:57.006Z'
epss: 0.00405
epssPercentile: 0.34533
---

## Overview

PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/template@v1.0.0. The resolver stores the user-controlled template path and ref verbatim, and the cache layer later joins those values into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalizing each segment or checking that the final path remains inside the template cache root. A crafted ref such as ../../../../../../outside-delete-target therefore escapes the cache directory. The first load can write .cache_meta.json outside the cache. If the normal cache hierarchy for the same owner/repo/template has already been created, the same path reaches shutil.rmtree(cache_path) and removes an attacker-selected outside directory before replacing it with cache metadata. This issue has been patched in version 4.6.59.

## Affected

- `PraisonAI >= 2.6.0, < 4.6.59`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-57113)

Affected packages:

- `praisonai >= 2.6.0, < 4.6.59`

Patched in:

- `praisonai 4.6.59`

Source: https://osv.dev/vulnerability/GHSA-f44v-7qgw-9gh9