CVE-2026-58413 in Network-AI
Summary
by MITRE • 07/20/2026
Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and only checks that this path exists. It does not resolve the result or verify that it remains under `data/<env>/.backups`. A caller can pass a traversal backup ID such as `../../../outside/source-dir` to restore files from an arbitrary directory into the target environment data directory. The issue is fixed in v5.12.2. `restore()` now validates `backupId` against `/^[\w\-]+$/` and asserts `dirname(resolve(join(backupsDir, backupId))) === resolve(backupsDir)` before touching the filesystem. Backup IDs containing path separators or `..` are rejected, so a crafted ID can no longer copy directories from outside `.backups/` into the environment.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The Network-AI multi-agent orchestrator presents a critical directory traversal vulnerability in its EnvironmentManager.restore() function prior to version 5.12.2. This flaw resides in the path construction and validation logic that processes backup identifiers within the data directory structure. The vulnerability stems from inadequate input sanitization where the system accepts arbitrary backup IDs without proper verification of their containment within the designated backups directory. The function computes backup paths using join(envDir, '.backups', backupId) and performs only a basic existence check rather than comprehensive path resolution and validation against the intended security boundaries.
The technical implementation of this vulnerability allows malicious actors to exploit path traversal by supplying specially crafted backup IDs containing relative path components such as parent directory references. When a caller provides a backup ID like '../../../outside/source-dir', the system processes this input through the join operation without resolving the resulting path or verifying that it remains within the confines of the intended data/<env>/.backups directory structure. This failure in path validation creates an arbitrary file read and write scenario where files from outside the backups directory can be copied into the target environment data directory, effectively bypassing access controls and potentially enabling unauthorized data manipulation.
The operational impact of this vulnerability extends beyond simple privilege escalation to encompass potential data integrity compromise and unauthorized system access. An attacker could leverage this flaw to restore malicious files into critical environment directories, potentially executing arbitrary code or corrupting legitimate backup data. The vulnerability directly maps to CWE-22 Path Traversal and aligns with ATT&CK technique T1059 Command and Scripting Interpreter, as it enables the execution of commands through manipulated file restoration processes. Organizations using Network-AI versions prior to 5.12.2 face significant risk of unauthorized data access and system compromise.
The fix implemented in version 5.12.2 addresses this vulnerability through multiple defensive measures that align with security best practices for input validation and path containment. The solution introduces regex validation against /^[\w\-]+$/ pattern to restrict backup IDs to alphanumeric characters, underscores, and hyphens, effectively blocking any attempt to include path separators or parent directory references. Additionally, the implementation now performs explicit path resolution verification using dirname(resolve(join(backupsDir, backupId))) === resolve(backupsDir) assertion before any filesystem operations occur. This dual-layer approach ensures that even if malformed input attempts to bypass the regex validation, the path resolution check prevents any movement outside the designated backups directory boundaries. The mitigations effectively address the root cause by enforcing strict containment policies and preventing the exploitation of path traversal vulnerabilities through comprehensive input sanitization and path validation mechanisms.