Duplicate Advisory: PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

PraisonAI before version 4.6.78 has a path traversal vulnerability (CWE-22) in its ContextGatherer feature. The vulnerability arises because the software does not properly validate include paths specified in .praisoncontext and .praisoninclude files. This allows an attacker to use absolute paths or directory traversal sequences to read files outside the workspace boundary and include their contents in the generated context bundle. The vulnerability is rated medium severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).

An attacker with local access and the ability to supply crafted .praisoncontext or .praisoninclude files can read arbitrary files outside the workspace. This leads to high confidentiality impact as sensitive files may be exposed. There is no impact on integrity or availability. The vulnerability requires user interaction and local access, limiting remote exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links are provided and the advisory is a duplicate withdrawn in favor of GHSA-q7m5-3jmv-vm48, consult that advisory for official fixes or mitigations. Until patched, avoid processing untrusted .praisoncontext or .praisoninclude files and restrict file access permissions to limit exposure.