THREAT OPS › Threat News › [GHSA] GHSA-gxmw-5f7x-6g22 (high) — praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location
[GHSA] GHSA-gxmw-5f7x-6g22 (high) — praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location
GHSA-gxmw-5f7x-6g22 Severity: high CVE: CVE-2026-55527
praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location
### Summary
`praisonaiagents/memory/file_memory.py::FileMemory.__init__()` constructs all memory file paths by directly joining the `user_id` parameter to a base path:
```python self.user_path =
MITRE ATT&CK techniques
- Written ContentT1683.001
Indicators of compromise
- CVE-2026-55527cve
Original source: https://github.com/advisories/GHSA-gxmw-5f7x-6g22