CVE-2026-120313 Details
Description
Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.
A path traversal vulnerability has been identified in the Network-AI package, specifically in versions prior to 5.15.5. The issue arises in the InputSanitizer.sanitizePath() function, which fails to properly confine paths to their intended base directory. Attackers can exploit this by supplying sibling-directory paths that share a string prefix with the base directory, bypassing the inadequate containment check. This vulnerability allows unauthorized reading, listing, or writing of files outside the designated sandbox environment.
Users can upgrade to Network-AI version 5.15.5 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-5mm5-4mh4-6gm6 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-5mm5-4mh4-6gm6 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/network-ai-before-5.15.5-path-traversal-via-inputsanitizer-sanitizepath | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Jovancoding Network-AI | <= 5.15.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |