CVE-2026-55527

### Summary `praisonaiagents/memory/file_memory.py::FileMemory.__init__()` constructs all memory file paths by directly joining the `user_id` parameter to a base path: ```python self.user_path = self.base_path / user_id # LINE 145 — no sanitization ``` No validation or normalization is applied to `user_id` before the path join. An attacker who can supply a `user_id` containing `../` sequences can write arbitrary JSON files (memory content) to **any writable location on the filesystem**. The vulnerability is confirmed **live on the current `main` branch** (`praisonaiagents==1.6.52`) and is **distinct from GHSA-766v-q9x3-g744** (which covered `MultiAgentMonitor` in an example file, not `FileMemory` in the core library). ### Details **Vulnerable code — `praisonaiagents/memory/file_memory.py` lines 139-157:** ```python def __init__( self, user_id: str = "default", base_path: Optional[str] = None, ... ): ... self.user_path = self.base_path / user_id # LINE 145 — NO SANITIZATION self.episodic_path = self.user_path / "episodic" self.user_path.mkdir(parents=True, exist_ok=True) # creates dirs at traversed path self.episodic_path.mkdir(parents=True, exist_ok=True) self.config_file = self.user_path / "config.json" self.short_term_file = self.user_path / "short_term.json" self.long_term_file = self.user_path / "long_term.json" self.entities_file = self.user_path / "entities.json" self.summaries_file = self.user_path / "summaries.json" ``` All five JSON files are written under `user_path`, which is directly derived from the attacker-controlled `user_id`. The written content is valid JSON in the memory item format (configurable user content + metadata). **Comparison with the patched reference — `praisonaiagents/storage/backends.py` (SQLiteBackend):** The sibling `SQLiteBackend` validates its `table_name` with a regex: ```python if not re.match(r'^[a-zA-Z0-9_]+$', table_name): rais