CVE-2026-60088 is a path traversal vulnerability in MervinPraison's PraisonAI product before version 4.6.78. The software fails to properly validate file path inputs in custom command templates, enabling attackers to include path traversal sequences (e.g., '@../outside_secret.txt') or absolute paths. This flaw allows attackers to exfiltrate files readable by the process from outside the workspace into model prompts. The vulnerability requires local access (AV:L) and user interaction (UI:P), with no privileges required (PR:N).

Successful exploitation allows an attacker to read arbitrary files accessible by the PraisonAI process outside the intended workspace directory. This can lead to unauthorized disclosure of sensitive information contained in those files. There is no indication of privilege escalation, code execution, or denial of service from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor MervinPraison's advisories for updates. Until a fix is available, avoid using untrusted custom command templates that include file path references and restrict access to the PraisonAI environment to trusted users only.