{"id":"CVE-2026-44340","aliases":["GHSA-9q28-ghcr-c4x3","PYSEC-2026-2909"],"url":"https://o3.security/vulnerability/CVE-2026-44340","summary":"PraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`","details":"PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member's name for absolute paths, .. segments, and resolved-path escape — but does not validate member.linkname, does not reject symlink/hardlink members, and calls tar.extractall(dest_dir) without filter=\"data\". A bundle that contains a symlink with a name inside dest_dir but a linkname pointing outside it, followed by a regular file whose path traverses through the just-created symlink, escapes dest_dir and lets the attacker write arbitrary content to an attacker-chosen location on the victim's filesystem. This issue has been patched in version 4.6.37.","published":"2026-05-08T13:38:47.812Z","modified":"2026-08-07T11:51:08.130800603Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"praisonai","fixedVersion":"4.6.37"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44340.json"},{"type":"ADVISORY","url":"https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9q28-ghcr-c4x3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44340"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T11:51:08.130800603Z"}}