PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)
PraisonAI, an AI agent framework, includes a FileTools component meant to restrict file operations to safe paths. A flawed check lets attackers bypass that restriction using directory traversal sequences like '../', giving them read, write, or delete access to any file on the host running the agent.
How the attack works
The FileTools validation function normalizes a given file path first, which collapses sequences like '/tmp/../etc/passwd' down to '/etc/passwd'. Only after this normalization does it check whether the path still contains '..' — but by then the traversal marker is already gone, so the check never blocks anything. An attacker asks the agent (directly or via a crafted prompt/instruction) to read, write, or delete a path such as '/tmp/../etc/passwd', and the broken check waves it through. The agent then performs the file operation on a path the attacker chose, outside any intended sandbox directory.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c78a1a85-db59-412d-8702-33cb80aa88ac
- Severity
- Critical
- CVEs
- CVE-2026-35615
Why it matters
An attacker can read sensitive files (credentials, config, source code), overwrite arbitrary files, or delete files anywhere the agent process has filesystem access — potentially leading to full host compromise or data theft.
What you can do
- →Upgrade PraisonAI to a version that fixes GHSA-693f-pf34-72c5 (fixed after 1.5.113).
- →Until patched, restrict the agent process's filesystem permissions so it cannot reach sensitive paths outside its intended working directory.
- →Monitor FileTools operations (read_file, write_file, delete_file) for path arguments containing '../' or absolute paths outside the expected sandbox.
- →Review any agent-facing input that can influence file paths and add independent path validation (e.g., resolve and confirm the path stays within an allowed directory) rather than relying on string checks alone.
Known benign look-alikes
- Legitimate FileTools.read_file('/workspace/data/report.txt') with an absolute path and no '..' traversal segment.
- Security advisory or changelog text that names CVE-2026-35615 but contains no traversal payload.
- Discussion of os.path.normpath usage in code review without a '../' traversal sink.