CVE-2026-120313

Name of the Vulnerable Software and Affected Versions Network-AI versions prior to 5.15.5

Description A path traversal issue exists in the sanitizePath() function of the InputSanitizer class. This occurs because of an unanchored startsWith check, which allows attackers to use sibling-directory paths that share a string prefix with the base directory. By exploiting this, an attacker can escape the sandbox to read, list, or write files outside the intended base directory.

Recommendations Update Network-AI to version 5.15.5 or later. As a temporary mitigation, restrict access to the sanitizePath() function within the InputSanitizer class.