PraisonAI versions before 1.5.113 have a CWE-22 path traversal vulnerability related to the template installation feature. When extracting template archives downloaded from external sources, the software uses Python's zipfile.extractall() without checking if files in the archive escape the intended extraction directory. This Zip Slip vulnerability enables arbitrary file writes outside the designated folder. The vulnerability has a CVSS 3.1 score of 8.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, but high integrity and availability impacts. The vulnerability is fixed in version 1.5.113.

An attacker who can trick a user into downloading and extracting a malicious template archive may cause arbitrary files to be written outside the intended directory. This can lead to integrity and availability impacts such as overwriting critical files or disrupting application functionality. There is no confidentiality impact reported. No known exploits in the wild have been documented.

Upgrade PraisonAI to version 1.5.113 or later, where this vulnerability is fixed. Since no official patch links or vendor advisory are provided, confirm the upgrade version from the vendor's official release notes. Until upgraded, avoid downloading and extracting template archives from untrusted external sources to reduce risk.