What is CVE-2026-120313 in Network-AI?
CVE-2026-120313 is a path traversal vulnerability impacting versions of Network-AI prior to 5.15.5, carrying a high CVSS score of 7.5 according to official data como se detalla en nuestros avisos previos sobre fallos de seguridad.
The flaw originates specifically within the InputSanitizer.sanitizePath() function, which fails to correctly enforce base directory boundaries against specially crafted inputs.
Who is affected by this path traversal flaw?
This security issue affects all deployments utilizing Network-AI versions earlier than 5.15.5 where input paths are processed without proper anchor validation siguiendo patrones similares a otras incidencias de privilegios.
Attackers can leverage this weakness to escape the designated base directory by supplying paths whose directory names share a string prefix with the base, successfully bypassing unanchored checks.
How does the vulnerability work?
The vulnerability allows malicious actors to read, list, or write files outside the sandbox environment, creating significant risks for data confidentiality and system integrity tal y como ocurre en vectores de escalada de privilegios.
By exploiting the unanchored startsWith check in InputSanitizer, external entities can manipulate sibling directory paths without authentication.
How do I mitigate this vulnerability?
System administrators must apply the latest software updates as documented in the official GitHub and VulnCheck advisories.
Review your environment configurations and ensure proper sandboxing limits are enforced alongside the patch.
- Verify your current Network-AI version is below 5.15.5.
- Check the official GitHub advisory for patch release details.
- Update Network-AI to version 5.15.5 or higher immediately.
- Audit file system permissions around the sandbox directories.