What’s Vulnerable › Vulnerabilities
CVE-2026-44340: PraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2026-05-08 · updated 2026-06-17
- Weakness: CWE-22
Description
PraisonAI is a multi-agent teams system. Prior to version 4.6.37, the _safe_extractall helper that all recipe pull, recipe publish, and recipe unpack flows route through validates each archive member's name for absolute paths, .. segments, and resolved-path escape — but does not validate member.linkname, does not reject symlink/hardlink members, and calls tar.extractall(dest_dir) without filter="data". A bundle that contains a symlink with a name inside dest_dir but a linkname pointing outside it, followed by a regular file whose path traverses through the just-created symlink, escapes dest_dir and lets the attacker write arbitrary content to an attacker-chosen location on the victim's filesystem. This issue has been patched in version 4.6.37.
Affected products
- MervinPraison PraisonAI: before 4.6.37 — fixed in 4.6.37
How to fix
Upgrade to a fixed version: MervinPraison PraisonAI 4.6.37. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-44340 or the next vulnerability affects your stack