CVE-2026-120313 Jovancoding CVE debrief

Who should care

Defenders and security teams responsible for Network-AI deployments should assess exposure and prioritize patching to prevent potential path traversal attacks. This includes reviewing and updating the InputSanitizer.sanitizePath() function, monitoring for potential attacks, and implementing additional security measures. Security teams should also verify the version of Network-AI and apply patches if necessary.

Why it matters

CVE-2026-120313 is a high-severity path traversal vulnerability in Network-AI before 5.15.5 that allows attackers to escape the base directory and potentially access or modify files outside the sandbox. Defenders and security teams responsible for Network-AI deployments should assess exposure and prioritize patching to prevent potential path traversal attacks.

• Potential unauthorized file access or modification outside the sandbox
• Possible data breaches or integrity loss due to path traversal
• Need for verification of Network-AI version and patch application
• Potential for attackers to escape the sandbox and access sensitive data

Technical summary

The InputSanitizer.sanitizePath() function in Network-AI before 5.15.5 is vulnerable to path traversal attacks. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox. The vulnerability has a CVSS score of 8.7 and is considered high-severity. Defenders and security teams responsible for Network-AI deployments should assess exposure and prioritize patching to prevent potential path traversal attacks.

Defensive priority

Defenders should prioritize verifying the version of Network-AI and applying the necessary patches to prevent potential path traversal attacks.

Recommended defensive actions

• Verify the version of Network-AI and apply patches if necessary
• Review and update InputSanitizer.sanitizePath() function to prevent path traversal attacks
• Monitor for potential attacks and implement additional security measures
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was reported by an unknown vendor and has a CVSS score of 8.7. The CVE record was published on 2026-11-02T03:17:29.053Z and has not been modified since then. The vulnerability affects Network-AI before version 5.15.5 and is considered high-severity. The InputSanitizer.sanitizePath() function is vulnerable to path traversal attacks, allowing attackers to escape the base directory and potentially access or modify files outside the sandbox.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.