Affected: MervinPraison PraisonAI

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the FileMemory constructor joins unsanitized user_id into self.user_path. A caller supplying ../ or path separators can escape the memory directory and write JSON data to arbitrary process-writable locations. The fix sanitizes user_id before constructing self.user_path. This issue is fixed in version 1.6.58.

Affected: PyPI: praisonaiagents

### Summary

`praisonaiagents/memory/file_memory.py::FileMemory.__init__()` constructs all memory file paths by directly joining the `user_id` parameter to a base path:

```python self.user_path = self.base_path / user_id # LINE 145 — no sanitization ```

No validation or normalization is applied to `user_id` before the path join. An attacker who can supply a `user_id` containing `../` sequences can write arbitrary JSON files (memory content) to **any writable location on the filesystem**.

The vulnerability is confirmed **live on the current `main` branch** (`praisonaiagents==1.6.52`) and is **distinct from GHSA-766v-q9x3-g744** (which covered `MultiAgentMonitor` in an example file, not `FileMemory` in the core library).

### Details

**Vulnerable code — `praisonaiagents/memory/file_memory.py` lines 139-157:**

```python def __init__( self, user_id: str = "default", base_path: Optional[str] = None, ... ): ... self.user_path = self.base_path / user_id # LINE 145 — NO SANITIZATION self.episodic_path = self.user_path / "episodic"

self.user_path.mkdir(parents=True, exist_ok=True) # creates dirs at traversed path self.episodic_path.mkdir(parents=True, exist_ok=True)

self.config_file = self.user_path / "config.json" self.short_term_file = self.user_path / "short_term.json" self.long_term_file = self.user_path / "long_term.json" self.entities_file = self.user_path / "entities.json" self.summaries_f…