HIGH 8.7 NVD
CVE-2026-120313
Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibli
Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.
References
- https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-5mm5-4mh4-6gm6
- https://www.vulncheck.com/advisories/network-ai-before-5.15.5-path-traversal-via-inputsani
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-11-02 via NVD.
vulnfeed aggregates 15261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.