CVE-2026-120312 in Network-AI
Summary
by MITRE • 11/02/2026
Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save() to disclose sensitive JSON data or overwrite policy files such as AuthGuardian trust-level configuration.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/02/2026
The Network-AI software suite, specifically versions ranging from 5.13.4 up to but not including 5.15.5, contains a critical path traversal vulnerability within the AgentVCR component. This flaw stems from insufficient validation of user-supplied input when handling cassette names, which are intended to identify specific data recording or playback sessions. The vulnerability allows an attacker who can control the name of the cassette to manipulate file system paths through the use of directory traversal sequences such as dot-dot-slash characters. By injecting these sequences into the parameters passed to internal functions like load() and save(), an adversary can bypass expected directory boundaries, effectively redirecting file operations outside of the intended sandboxed or application-specific directories.
From a technical perspective, this is a classic example of improper input validation leading to unauthorized access to sensitive files. The vulnerability aligns with Common Weakness Enumeration identifier CWE-22: Improper Limitation of a Pathname to a Restricted Directory. When an attacker provides a maliciously crafted cassette name containing path traversal characters, the underlying file system operations interpret these sequences as instructions to move up directory levels or navigate into arbitrary locations on the host operating system. This lack of sanitization permits the reading and writing of files that are not part of the normal application workflow, breaking the principle of least privilege by granting access beyond the scope intended for the AgentVCR module.
The operational impact of this vulnerability is severe due to the nature of the data involved. Attackers can exploit this flaw to read arbitrary JSON configuration files stored on the system. These files often contain sensitive information such as API keys, authentication tokens, database credentials, or internal network topology details. Furthermore, the ability to write to these locations allows for more destructive attacks. An attacker could overwrite critical policy files, specifically targeting AuthGuardian trust-level configurations. By modifying these configuration files, an adversary can alter security policies, potentially disabling access controls, elevating privileges, or establishing persistent backdoors within the Network-AI infrastructure. This capability transforms a simple data disclosure issue into a potential full system compromise scenario where integrity and confidentiality are both violated.
This vulnerability is categorized under MITRE ATT&CK technique T1083: File and Directory Discovery for information gathering and T1222: File Permission Modification if the attacker modifies access rights, or more directly T1564: Hidden Files and Directories if used to hide malicious artifacts, though its primary classification relates to unauthorized file access. The exploitation requires an actor who has some level of interaction with the AgentVCR component, such as a compromised service account or a user with permission to initiate cassette operations. Once exploited, the attacker gains the ability to exfiltrate sensitive configuration data and manipulate security-critical settings without direct authentication bypasses at the application login layer, relying instead on logic flaws within specific API endpoints.
Mitigation strategies must focus on immediate patching and defensive coding practices. The primary remediation is to upgrade Network-AI to version 5.15.5 or later, where this path traversal issue has been addressed by implementing strict input validation and canonicalization of file paths before they are processed by the load() and save() functions. Developers should ensure that all user-supplied filenames are checked against a whitelist of allowed characters and that any resulting absolute path is verified to reside within an expected base directory using secure comparison methods rather than simple string matching. Additionally, implementing principle of least privilege for the application runtime environment can limit the damage if such vulnerabilities persist by restricting file system permissions so that even successful traversal cannot access critical configuration directories or sensitive data stores. Regular security audits and static code analysis focused on CWE-22 patterns are recommended to detect similar issues in other components of the software suite.