A path traversal vulnerability in PraisonAI's MultiAgentMonitor enables attackers to manipulate file paths, leading to potential sensitive data disclosure or remote code execution.

The vulnerability exists in the MultiAgentMonitor component, which fails to properly sanitize agent IDs during file path construction. Attackers can use path traversal sequences such as ../ to access files outside the intended directory.

This vulnerability carries a CVSS score of 8.8, indicating a high risk to data confidentiality and integrity. Successful exploitation could allow attackers to read configuration files, overwrite sensitive system files, or execute malicious code, leading to complete system compromise.

Immediate Action: Upgrade to PraisonAI version 1.5.115 or later immediately to enforce proper path sanitization.

Proactive Monitoring: Monitor filesystem access logs for unusual read or write activity, especially patterns containing directory traversal sequences.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block requests containing directory traversal characters (../) before they reach the application.

Public Exploit Available: true

Given that a public exploit is available, this vulnerability is actively dangerous. Administrators must prioritize updating PraisonAI to version 1.5.115 or later to mitigate the risk of file system manipulation and potential system compromise.