CVE-2026-55527: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in MervinPraison PraisonAI

PraisonAI, a multi-agent teams system, had a path traversal vulnerability (CWE-22) due to improper sanitization of the user_id parameter in the FileMemory constructor. Before version 1.6.58, an attacker could supply '../' or other path separators in user_id to escape the designated memory directory and write JSON data to arbitrary process-writable locations. The vulnerability was addressed by sanitizing user_id before constructing the file path in version 1.6.58.

The vulnerability allows an attacker with limited privileges (PR:L) to write JSON data to arbitrary locations writable by the process, potentially leading to integrity violations. Confidentiality is not impacted, and availability impact is low. The CVSS score is 7.1 (high severity).

Upgrade PraisonAI to version 1.6.58 or later, where the user_id input is properly sanitized to prevent path traversal. No other mitigation is indicated or required.