PraisonAI Action Orchestrator step.target Path Traversal Arbitrary File Write RCE (CVE-2026-39305 / GHSA-jfxc-v5g9-38xr)
PraisonAI's Action Orchestrator lets an AI agent create or edit files as part of a task. A flaw in versions before 4.5.113 fails to check whether the file path stays inside the intended workspace folder, so an attacker can supply a path containing '../' sequences to write files anywhere on the system the agent process can reach.
How the attack works
An attacker gets a FILE_CREATE or FILE_EDIT action step executed by the orchestrator, either by controlling task input or manipulating the agent's instructions. The step's target field contains a traversal sequence like '../../' instead of a plain filename. Because the orchestrator concatenates the workspace path with this target without resolving or validating it, the write lands outside the workspace. By targeting files such as ~/.ssh/authorized_keys or ~/.bashrc, the attacker can plant an SSH key or shell startup command that runs with the privileges of the agent process, giving them remote code execution.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d3e3629d-4013-4ba0-bfc9-7b0750d30412
- Severity
- Critical
- CVEs
- CVE-2026-39305
Why it matters
An attacker can turn a file-writing agent capability into full remote code execution on the host running PraisonAI, potentially gaining persistent SSH access or arbitrary command execution outside any sandbox the workspace was meant to provide.
What you can do
- →Upgrade PraisonAI to 4.5.113 or later, which resolves and boundary-checks step.target paths.
- →Until patched, validate or reject any ActionStep target containing '../' or resolving outside the workspace directory before executing FILE_CREATE/FILE_EDIT steps.
- →Run agent workspaces with a dedicated low-privilege user and restrict filesystem access outside the intended workspace directory.
- →Monitor for FILE_CREATE/FILE_EDIT actions targeting sensitive paths like ~/.ssh/authorized_keys or ~/.bashrc, and alert on any traversal sequences in file write requests.
Known benign look-alikes
- Legitimate PraisonAI ActionStep FILE_CREATE/FILE_EDIT whose target is a normal relative filename inside the workspace (no ../ traversal).
- Incident-response or hardening checklists that mention ~/.ssh/authorized_keys or .bashrc defensively, without any path-traversal write.
- Security advisory text quoting CVE-2026-39305 as a fixed/mitigated issue without an executable traversal payload.