CVE-2026-58413

Katalog CVE

CVSS 6.1 · Medium EPSS 0,19%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada network-ai. Skor CVSS 3.1 6.1 (Medium) menurut github.com.

Deskripsi (NVD)

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and only checks that this path exists. It does not resolve the result or verify that it remains under `data/<env>/.backups`. A caller can pass a traversal backup ID such as `../../../outside/source-dir` to restore files from an arbitrary directory into the target environment data directory. The issue is fixed in v5.12.2. `restore()` now validates `backupId` against `/^[\w\-]+$/` and asserts `dirname(resolve(join(backupsDir, backupId))) === resolve(backupsDir)` before touching the filesystem. Backup IDs containing path separators or `..` are rejected, so a crafted ID can no longer copy directories from outside `.backups/` into the environment.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

13 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23: Relative Path Traversal

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-48x2-6pr9-2jjf exploit · patch · advisory vendor
• https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3 patch
• https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2 patch · release notes