CVE-2026-120311 Jovancoding CVE debrief

Who should care

Defenders responsible for Network-AI instances, especially those using AuthGuardian authorization, should assess exposure and prioritize verification and remediation efforts. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that their instances are updated to version 5.15.5 or later and that appropriate security measures are in place to protect against potential exploitation.

Why it matters

CVE-2026-120311 is a path traversal vulnerability in Network-AI's FileJobStore that allows attackers to read or delete arbitrary .json files, potentially disclosing credentials and tokens or deleting configuration files, which could weaken AuthGuardian authorization. Defenders should prioritize verifying the presence of this vulnerability in their Network-AI instances, especially in environments where AuthGuardian authorization is critical.

• Potential disclosure of sensitive credentials and tokens
• Deletion of configuration files weakening AuthGuardian authorization
• Possible disruption of critical services or data
• Need for verification of affected versions and exposure

Technical summary

The vulnerability exists in the FileJobStore component of Network-AI, versions 5.13.4 to 5.15.4. An attacker can exploit this vulnerability by supplying traversal sequences in the job id, allowing them to read or delete arbitrary .json files. This could lead to disclosure of sensitive information, such as credentials and tokens, or deletion of configuration files, weakening AuthGuardian authorization.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their Network-AI instances and assess exposure, especially in environments where AuthGuardian authorization is critical.

Recommended defensive actions

• Verify the version of Network-AI and ensure it is 5.15.5 or later
• Restrict access to FileJobStore and JobQueue to prevent unauthorized manipulation of job IDs
• Monitor for suspicious activity related to .json file access or deletion
• Implement additional security measures to protect AuthGuardian authorization
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information from the vendor and other sources is limited. The vulnerability is described as a path traversal issue in FileJobStore, allowing attackers to read or delete arbitrary .json files.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.