CVE-2026-120311

Summary

A path traversal flaw in the FileJobStore component of Network-AI (versions before 5.15.5) allows authenticated attackers to read or delete arbitrary .json files by injecting directory traversal sequences (e.g., ../../) into job IDs passed to get(), delete(), or getJob() functions, enabling credential theft and configuration file deletion.

Exploitability

Exploitation requires low skill and only valid authentication credentials, with no user interaction needed.

Blast radius

Successful exploitation could lead to full compromise of AuthGuardian authorization by leaking sensitive tokens/credentials or deleting critical configuration files, potentially disabling access controls across the system.

Detection

Monitor for requests to FileJobStore endpoints containing path traversal patterns (e.g., %2e%2e/, ..%2f, %252e%252e) in job ID parameters, especially when combined with .json file extensions or unexpected file access attempts.

Prioritized remediation

Upgrade Network-AI to version 5.15.5 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.