CVE-2026-60088 describes a path traversal vulnerability in MervinPraison's PraisonAI product before version 4.6.78. The vulnerability arises because the software fails to properly validate file path references in custom command templates, enabling attackers to include sequences such as '@../outside_secret.txt' or absolute paths. This flaw allows attackers to read arbitrary files outside the restricted workspace, potentially exposing sensitive information. The CVSS 4.0 base score is 6.8, indicating a medium severity. The vulnerability requires local access (AV:L) and user interaction (UI:P), with no privileges required (PR:N).

Successful exploitation allows an attacker to read files outside the intended workspace directory, leading to unauthorized disclosure of potentially sensitive or confidential information accessible by the process running PraisonAI. There is no indication of privilege escalation, denial of service, or code execution impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor MervinPraison's advisories for updates. Until a fix is available, avoid using untrusted custom command templates that reference file paths, and restrict access to the PraisonAI environment to trusted users only.