PraisonAI versions before 1.5.113 have a path traversal vulnerability (CWE-22) in the template installation feature. When extracting zip archives from external sources, the application uses Python's zipfile.extractall() without verifying that extracted files remain within the target directory. This allows an attacker to craft a malicious archive that writes files outside the intended directory, leading to arbitrary file write. The vulnerability is addressed in version 1.5.113.

Successful exploitation allows an attacker to write arbitrary files to the filesystem outside the intended directory, potentially overwriting critical files and causing integrity and availability impacts. Confidentiality impact is not indicated. The CVSS score is 8.1 (high), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity and availability impact.

Upgrade PraisonAI to version 1.5.113 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in this version, applying the official update is the recommended remediation. No other mitigation or temporary workaround is specified.