{"id":"CVE-2026-39305","aliases":["GHSA-jfxc-v5g9-38xr","PYSEC-2026-475"],"url":"https://o3.security/vulnerability/CVE-2026-39305","summary":"Arbitrary File Write / Path Traversal in Action Orchestrator","details":"The Action Orchestrator feature contains a Path Traversal vulnerability that allows an attacker (or compromised agent) to write to arbitrary files outside of the configured workspace directory. By supplying relative path segments (`../`) in the target path, malicious actions can overwrite sensitive system files or drop executable payloads on the host.\n\n### Details\nLocation: `src/praisonai/praisonai/cli/features/action_orchestrator.py` (Lines 402, 409, 423)\n\nVulnerable Code snippet:\n```python\ntarget = workspace / step.target\n```\n\nIn the `_apply_step` method, paths are constructed by concatenating the `workspace` path with a user-supplied `step.target` string: `target = workspace / step.target`. The code fails to resolve and validate that the final absolute path remains within the bounds of the `workspace` directory. When processing `FILE_CREATE` or `FILE_EDIT` actions, this flaw permits arbitrary file modification.\n\n### PoC\nConstruct a malicious `ActionStep` payload with path traversal characters:\n\n```python\nfrom praisonai.cli.features.action_orchestrator import ActionStep, ActionType, ActionStatus\n\n# Payload targeting a file outside the workspace\nstep = ActionStep(\n    id=\"test_traversal\",\n    action_type=ActionType.FILE_CREATE,\n    description=\"Malicious file write\",\n    target=\"../../../../../../../tmp/orchestrator_pwned.txt\",\n    params={\"content\": \"pwned\"},\n    status=ActionStatus.APPROVED\n)\n\n# When the orchestrator applies this step, it writes to the traversed path\n# _apply_step(step)\n```\n\n### Impact\nThis is an Arbitrary File Write vulnerability. Anyone running the Action Orchestrator to apply modifications is vulnerable. A malicious prompt could trick the agent into generating a plan that overwrites critical files (e.g., `~/.ssh/authorized_keys`, `.bashrc`) leading to Remote Code Execution (RCE) or system corruption.","published":"2026-04-07T16:47:18.102Z","modified":"2026-08-12T03:51:29.239377410Z","cvss":{"score":9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H"},"epss":{"score":0.00306,"percentile":0.23179,"asOf":"2026-09-12"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"praisonai","fixedVersion":"4.5.113"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39305.json"},{"type":"ADVISORY","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-jfxc-v5g9-38xr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39305"},{"type":"PACKAGE","url":"https://github.com/MervinPraison/PraisonAI"},{"type":"WEB","url":"https://github.com/MervinPraison/PraisonAI/releases/tag/v4.5.113"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:29.239377410Z"}}