# PraisonAI FileTools _validate_path normpath Path Traversal (CVE-2026-35615 / GHSA-693f-pf34-72c5)

- **Severity:** Critical
- **Signature ID:** `c78a1a85-db59-412d-8702-33cb80aa88ac`
- **CVEs:** CVE-2026-35615
- **MITRE ATLAS:** AML.T0049 (Exploit Public-Facing Application)
- **OWASP:** ASI06 (Goal and Instruction Manipulation), LLM06 (Excessive Agency)

## Summary

PraisonAI, an AI agent framework, includes a FileTools component meant to restrict file operations to safe paths. A flawed check lets attackers bypass that restriction using directory traversal sequences like '../', giving them read, write, or delete access to any file on the host running the agent.

## How the attack works

The FileTools validation function normalizes a given file path first, which collapses sequences like '/tmp/../etc/passwd' down to '/etc/passwd'. Only after this normalization does it check whether the path still contains '..' — but by then the traversal marker is already gone, so the check never blocks anything. An attacker asks the agent (directly or via a crafted prompt/instruction) to read, write, or delete a path such as '/tmp/../etc/passwd', and the broken check waves it through. The agent then performs the file operation on a path the attacker chose, outside any intended sandbox directory.

## Why it matters

An attacker can read sensitive files (credentials, config, source code), overwrite arbitrary files, or delete files anywhere the agent process has filesystem access — potentially leading to full host compromise or data theft.

## What you can do

- Upgrade PraisonAI to a version that fixes GHSA-693f-pf34-72c5 (fixed after 1.5.113).
- Until patched, restrict the agent process's filesystem permissions so it cannot reach sensitive paths outside its intended working directory.
- Monitor FileTools operations (read_file, write_file, delete_file) for path arguments containing '../' or absolute paths outside the expected sandbox.
- Review any agent-facing input that can influence file paths and add independent path validation (e.g., resolve and confirm the path stays within an allowed directory) rather than relying on string checks alone.

## Known benign look-alikes

- Legitimate FileTools.read_file('/workspace/data/report.txt') with an absolute path and no '..' traversal segment.
- Security advisory or changelog text that names CVE-2026-35615 but contains no traversal payload.
- Discussion of os.path.normpath usage in code review without a '../' traversal sink.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01970
- https://nvd.nist.gov/vuln/detail/CVE-2026-35615

---
Source: https://www.netzilo.com/threats/atr-praisonai-filetools-validate-path-normpath-path-traversal-cv