PraisonAI multiedit Tool Path Traversal Enabling Arbitrary File Read/Write

Technical Analysis

The multiedit.py tool passes a filepath parameter, which originates from LLM output and can be steered via prompt injection, directly into Python's open() for both read and write operations. Because there is no path canonicalization, traversal sequence rejection (e.g. '../'), symlink resolution, or enforcement of a workspace root, an attacker who can influence the agent's instructions (via injected content in documents, tool outputs, or user input) can direct the edit/diff functionality to access files well outside the intended project directory. This crosses the boundary between LLM-generated intent and filesystem-level trust, letting a compromised prompt reach credentials, SSH keys, configuration files, or overwrite executable/startup files for persistence. The vulnerability is entirely within the tool-layer implementation rather than the model itself, meaning any agent or workflow that invokes this tool inherits the exposure regardless of the LLM used.

Affected Systems

PraisonAI

Detection Signatures

• File access logs showing multiedit tool operations on paths outside expected project/workspace roots
• Filepath parameters containing '../', absolute paths, or symlink indicators passed to edit/diff tools
• Unexpected reads/writes to sensitive paths (/etc/passwd, ~/.ssh, .env, credential stores) correlated with agent tool invocations
• Prompt or tool-call logs showing LLM-generated filepath arguments that diverge from user-specified or expected file targets
• Anomalous overwrite of application binaries, startup scripts, or configuration files following agent tool execution

Remediation Steps

1. 1

   Upgrade PraisonAI

   Update to PraisonAI version 4.6.62 or later, which fixes the multiedit path handling vulnerability.

2. 2

   Enforce workspace boundary checks

   Wrap file-access tools with canonicalization (realpath) and validation that resolved paths remain within an allow-listed workspace root before any read/write operation.

3. 3

   Reject traversal and symlinks

   Explicitly reject filepaths containing traversal sequences and resolve symlinks prior to access, denying operations that escape the sandbox.

4. 4

   Apply least-privilege process isolation

   Run agent tool execution in a sandboxed or containerized environment with restricted filesystem permissions so even a successful traversal cannot reach sensitive host files.

5. 5

   Audit and monitor tool file operations

   Log all file paths passed to edit/diff tools and alert on access to sensitive directories or files outside expected project scope.

6. 6

   Sanitize LLM-controlled parameters

   Treat any filepath or similar parameter derived from LLM output as untrusted input requiring strict validation before use in filesystem APIs.