PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, is_path_within_directory() uses os.path.abspath() rather than os.path.realpath() for the workspace boundary. A symlink inside workspace can point outside and still pass the check, allowing read_file and other code tools to access files outside the configured workspace. This issue is fixed in version 4.6.58.

CVE-2026-55540 affects PraisonAI, a multi-agent teams system, in versions prior to 4.6.51. The vulnerability exists in the is_path_within_directory() function, which uses os.path.abspath() instead of os.path.realpath() when enforcing workspace boundaries. This flaw allows a symlink placed inside the workspace to point to locations outside the workspace while still passing the boundary check. As a result, tools such as read_file can be abused to access arbitrary files on the filesystem outside the configured workspace. The vulnerability represents a path traversal/sandbox escape issue that could lead to unauthorized file disclosure. It is particularly relevant in multi-agent AI system contexts where workspace isolation is a security boundary. The issue was fixed in version 4.6.58 of PraisonAI. A patch commit and security advisory are publicly available on GitHub.