Summary
A path traversal vulnerability in PraisonAI's Dynamic Context tools allows lower-trust callers to use crafted run_id or agent_id values to access files outside the configured storage directory. Under deployments where untrusted prompts or users can invoke these agent-callable tools, attackers may read history and terminal-log files containing sensitive information.
A path traversal vulnerability in PraisonAI's Dynamic Context tools allows lower-trust callers to use crafted run_id or agent_id values to access files outside the configured storage directory. Under deployments where untrusted prompts or users can invoke these agent-callable tools, attackers may read history and terminal-log files containing sensitive information.
Affected context
The issue occurs in PraisonAI Dynamic Context deployments that store agent history and terminal logs on the filesystem and expose agent-callable tool factories accepting caller-controlled identifiers. It becomes risky when those identifiers are incorporated into file paths without confinement to the configured base directory, especially where lower-trust users or prompts can invoke the tools.
The issue occurs in PraisonAI Dynamic Context deployments that store agent history and terminal logs on the filesystem and expose agent-callable tool factories accepting caller-controlled identifiers. It becomes risky when those identifiers are incorporated into file paths without confinement to the configured base directory, especially where lower-trust users or prompts can invoke the tools.
Exploit preconditions
- Attack surface: Agent-callable Dynamic Context history and terminal-log tools
- Required access: Permission to invoke the exposed tools, directly or through an agent interaction
- Trigger point: Filesystem access using caller-supplied
run_idoragent_idvalues - Why exploitation is possible: The underlying stores accept absolute paths and traversal sequences instead of restricting resolved paths to the configured Dynamic Context directory
- Attack surface: Agent-callable Dynamic Context history and terminal-log tools
- Required access: Permission to invoke the exposed tools, directly or through an agent interaction
- Trigger point: Filesystem access using caller-supplied
run_idoragent_idvalues - Why exploitation is possible: The underlying stores accept absolute paths and traversal sequences instead of restricting resolved paths to the configured Dynamic Context directory
Why this happens
The vulnerability results from constructing filesystem paths by joining trusted storage locations with insufficiently constrained user-controlled identifiers. Absolute-path handling and parent-directory traversal can cause the resulting path to escape the intended base directory. This maps primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor describing the resulting information disclosure.
The vulnerability results from constructing filesystem paths by joining trusted storage locations with insufficiently constrained user-controlled identifiers. Absolute-path handling and parent-directory traversal can cause the resulting path to escape the intended base directory. This maps primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor describing the resulting information disclosure.
Potential impact
- An attacker may read
.jsonlhistory files outside the configured Dynamic Context directory. - An attacker may access terminal
.logfiles containing sensitive operational data. - Exposed files could reveal credentials, prompts, tool results, or internal system information.
- The disclosure could support further compromise or targeted attacks against connected services.
- An attacker may read
.jsonlhistory files outside the configured Dynamic Context directory. - An attacker may access terminal
.logfiles containing sensitive operational data. - Exposed files could reveal credentials, prompts, tool results, or internal system information.
- The disclosure could support further compromise or targeted attacks against connected services.
General mitigation guidance
Mitigation typically focuses on treating tool arguments as untrusted data and enforcing filesystem confinement at the storage boundary.
Common defensive patterns include:
- Rejecting absolute paths and traversal components in identifiers intended to name stored objects.
- Resolving candidate paths and verifying that they remain beneath the intended base directory.
- Allowing only canonical, schema-constrained identifiers rather than arbitrary path fragments.
- Using opaque server-generated references instead of caller-selected filesystem names.
- Applying least-privilege filesystem permissions and limiting the process view of sensitive directories.
- Separating agent-visible storage from credentials, host logs, and other unrelated application data.
These controls reduce exposure even when a caller can invoke the tools with unexpected values.
Mitigation typically focuses on treating tool arguments as untrusted data and enforcing filesystem confinement at the storage boundary.
Common defensive patterns include:
- Rejecting absolute paths and traversal components in identifiers intended to name stored objects.
- Resolving candidate paths and verifying that they remain beneath the intended base directory.
- Allowing only canonical, schema-constrained identifiers rather than arbitrary path fragments.
- Using opaque server-generated references instead of caller-selected filesystem names.
- Applying least-privilege filesystem permissions and limiting the process view of sensitive directories.
- Separating agent-visible storage from credentials, host logs, and other unrelated application data.
These controls reduce exposure even when a caller can invoke the tools with unexpected values.
How teams detect issues like this
Organizations can detect this class of issue through:
- Static analysis rules for filesystem joins involving tool arguments or other request-controlled values.
- Code review checks for missing absolute-path rejection, traversal validation, and base-directory containment checks.
- Dynamic tests using parent-directory segments, absolute paths, encoded separators, and symlink-related edge cases.
- Runtime monitoring for file access outside approved Dynamic Context directories.
- Policy enforcement requiring canonical-path validation and least-privilege service accounts.
Automated security review tools may help identify path construction patterns, but results should be validated against the application's filesystem behavior.
Organizations can detect this class of issue through:
- Static analysis rules for filesystem joins involving tool arguments or other request-controlled values.
- Code review checks for missing absolute-path rejection, traversal validation, and base-directory containment checks.
- Dynamic tests using parent-directory segments, absolute paths, encoded separators, and symlink-related edge cases.
- Runtime monitoring for file access outside approved Dynamic Context directories.
- Policy enforcement requiring canonical-path validation and least-privilege service accounts.
Automated security review tools may help identify path construction patterns, but results should be validated against the application's filesystem behavior.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
