CVE-2026-58484 Jovancoding CVE debrief

Who should care

Network-AI users and administrators should be aware of this vulnerability and take steps to patch their installations to prevent potential arbitrary path deletion. This issue may impact operators, platforms, vulnerability management teams, and security teams that use Network-AI. They should review and validate backup configurations to prevent potential abuse and restrict access to backup directories to prevent tampering. Additionally, they should prioritize patching to prevent potential arbitrary path deletion and review compensating controls for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should also be checked for extra review. Exceptions, retested remediated assets, and closed items should be tracked only after evidence is documented. Asset inventory and source tracking may also be necessary to ensure that all affected systems are accounted for and remediated. Rollback/change windows may be necessary to apply patches or mitigations. This issue may also require review of related CVE records and vendor advisories to ensure that all necessary steps are taken to mitigate the vulnerability. CVE-2026-58484 was published on 2026-07-20T17:18:16.160Z and has not been modified since then. The NVD entry is currently Analyzed. The CVE description indicates that prior to Network-AI version 5.12.2, the `EnvironmentManager.listBackups()` function reads each backup's `_manifest.json` and trusts the manifest's `path` field. This could allow an attacker to cause `EnvironmentManager.pruneBackups()` to recursively delete an arbitrary path accessible to the Network-AI process user. The issue is fixed in version 5.12.2, where `pruneBackups()` no longer passes `entry.path` from the on-disk manifest to `rmSync`. The deletion path is recomputed from a format-validated `entry.backupId`, and a `dirname` containment check confines deletion to exactly one level under the backups directory. A poisoned manifest (e.g. `path`: `/`) is now inert. This issue may impact operators, platforms, vulnerability management teams, and security teams that use Network-AI. They should review and validate backup configurations to prevent

Technical summary

The `EnvironmentManager.listBackups()` function in Network-AI prior to version 5.12.2 reads each backup's `_manifest.json` and trusts the manifest's `path` field. This could allow an attacker to cause `EnvironmentManager.pruneBackups()` to recursively delete an arbitrary path accessible to the Network-AI process user. The issue is fixed in version 5.12.2, where `pruneBackups()` no longer passes `entry.path` from the on-disk manifest to `rmSync`. The deletion path is recomputed from a format-validated `entry.backupId`, and a `dirname` containment check confines deletion to exactly one level under the backups directory.

Defensive priority

Network-AI users should prioritize patching to prevent potential arbitrary path deletion.

Recommended defensive actions

• Apply the patch by updating Network-AI to version 5.12.2 or later
• Review and validate backup configurations to prevent potential abuse
• Restrict access to backup directories to prevent tampering
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Perform asset inventory to ensure that all affected systems are accounted for and remediated

Evidence notes

The CVE description indicates that prior to Network-AI version 5.12.2, the `EnvironmentManager.listBackups()` function reads each backup's `_manifest.json` and trusts the manifest's `path` field. This could allow an attacker to cause `EnvironmentManager.pruneBackups()` to recursively delete an arbitrary path accessible to the Network-AI process user. The issue is fixed in version 5.12.2, where `pruneBackups()` no longer passes `entry.path` from the on-disk manifest to `rmSync`.

Official resources