CVE-2026-61431 is a path traversal vulnerability affecting MervinPraison's PraisonAI product before version 4.6.78. The vulnerability arises because the ContextGatherer component does not properly validate include paths specified in .praisoncontext and .praisoninclude files. Attackers can exploit this by providing absolute paths or directory traversal sequences (e.g., ../) to access files outside the intended workspace, which are then included in the generated context bundle. This can lead to unauthorized disclosure of arbitrary file contents. The CVSS 4.0 vector indicates local attack vector with low complexity, no privileges required, user interaction required, and high impact on confidentiality.

Successful exploitation allows an attacker with local access and the ability to influence .praisoncontext or .praisoninclude files to read arbitrary files outside the workspace. This results in unauthorized disclosure of sensitive information. The vulnerability does not require privileges but does require user interaction and local access. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to .praisoncontext and .praisoninclude files to trusted users only and monitor for suspicious modifications. Avoid running PraisonAI in environments where untrusted users can supply these files.