CVE-2026-56839 PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODETOOLS wrappers keep workspaceroot as None and pass workspace=None to readfile, searchreplace, and applydiff helpers that enforce path containment only for a truthy workspace. An application that exposes codereadfile,...

CVE-2026-56839

PraisonAI (Python package praisonai), a multi-agent LLM framework, is affected by a fail-open workspace boundary in its CODE_TOOLS wrappers. Prior to 4.6.59 , the global variable _workspace_root defaults to None, and the lower-level helpers (read_file, search_replace, apply_diff) only enforce pat...

CVE-2026-56839 PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODETOOLS wrappers keep workspaceroot as None and pass workspace=None to readfile, searchreplace, and applydiff helpers that enforce path containment only for a truthy workspace. An application that exposes codereadfile,...

CVE-2021-45010

CVE-2021-45010 🐍 Exploit PoC en Python creado para CVE-2021-45010. Tiny File Manager 2.4.7 Uso root@kitploit: usage: main.py -h -u URL -l USERNAME -p PASSWORD -g GUIPATH -r FSRELPATH options: -h, --help show this help message and exit -u URL, --url URL Base URL -l USERNAME, --username USERNAME...

CVE-2024-23334

CVE-2024-23334 Prueba de concepto para la vulnerabilidad de LFI/Path Traversal en Aiohttp = !IMPORTANT Este script está destinado únicamente con fines educativos. Cualquier uso ilegal está estrictamente prohibido. ¿Cómo ejecutar? root@kitploit: $ git clone...

CVE-2026-57119 PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agentfile path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files...

CVE-2026-57119 PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agentfile path in POST /api/v1/runs and passes it to the job executor without a workspace allowlist or boundary check. A remote caller can cause the server to open files...

CVE-2026-57129

PraisonAI (praisonaiagents Python package) is vulnerable to arbitrary file read via the MentionsParser._process_file_mention function in mentions.py. When an @file: mention path is not found relative to the workspace, the code falls back to Path(file_path) without traversal, symlink, or workspace...

EUVD-2026-77543

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser.processfilemention accepts file-mention values and falls back from workspace-relative resolution to Pathfilepath without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or...

CVE-2026-57129 PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser.processfilemention accepts file-mention values and falls back from workspace-relative resolution to Pathfilepath without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or...

CVE-2024-9047-Exploit

CVE-2024-9047: Exploit para el plugin WordPress File Upload Descripción El plugin WordPress File Upload para WordPress es vulnerable a una vulnerabilidad de Path Traversal en todas las versiones hasta la 4.24.11, inclusive, a través del archivo wfufiledownloader.php. Esta vulnerabilidad permite a...

CVE-2021-41773_CVE-2021-42013_Exploits

Explotando CVE-2021-41773 y CVE-2021-42013 Descripción general Este repositorio se centra en explotar dos vulnerabilidades en Apache HTTPD: CVE-2021-41773 y CVE-2021-42013. Estos CVE representan vulnerabilidades de path traversal que potencialmente pueden conducir a mapeo de archivos y ejecución...

gonc

Introducción a gonc README en 中文 、 English gonc es una herramienta netcat basada en Golang diseñada para facilitar la comunicación peer-to-peer. Sus características principales incluyen: 🔁 NAT Traversal automatizado : Configuración cero. Ambas partes solo necesitan acordar una frase de contraseña...

CVE-2024-3400-pot

CVE-2024-3400-pot Honeypot simple para la vulnerabilidad de inyección de comandos CVE-2024-3400 de Palo Alto PAN-OS. Características Simular la visita a /global-protect/login.esp página de inicio de sesión del Portal GlobalProtect Simular la petición HTTP POST /ssl-vpn/hipreport.esp & Cookie:...

CVE-2024-53691

CVE-2024-53691 https://www.qnap.com/en/security-advisory/qsa-24-28 https://vulners.com/cve/CVE-2024-53691 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N 8.7 "Si se explota, la vulnerabilidad de seguimiento de enlaces podría permitir a atacantes remotos que hayan obtenido acceso d...

EUVD-2026-77530

Description A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the...

CVE-2026-82427 Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name

Description A topology's topology.blobstore.map lets the submitter choose a local name for each blob that the supervisor localises. That name was used to build a path under the topology's working directory without normalisation, in both AsyncLocalizer and Container.createBlobstoreLinks, and the...

CVE-2026-82427

Apache Storm is vulnerable to a path traversal in its blobstore localisation logic. The topology.blobstore.map local name was used to build a file path under the topology's working directory without normalisation in both AsyncLocalizer and Container.createBlobstoreLinks. A submitter could inject ...

CVE-2021-41773

Imágenes Docker vulnerables para CVE-2021-41773 Apache path traversal Esta vulnerabilidad solo aplica a la versión 2.4.49 que tiene configuraciones específicas no predeterminadas. En ciertas situaciones, esto puede resultar en lectura de archivos o ejecución de código...

EUVD-2026-77515

Description Nimbus accepted the uploadedJarLocation argument of submitTopology / submitTopologyWithOpts as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded. The intended flow is that a client first calls beginFileUpload, which...