Network-AI FileJobStore Path Traversal Vulnerability Analysis and Mitigation Guide (CVE-2026-120311)
Executive & SecOps Summary
SECOPS ASSESSMENTNetwork-AI versions from 5.13.4 before 5.15.5
Attackers can read or delete arbitrary .json files by supplying path traversal sequences in the job ID, potentially disclosing credentials, granting unauthorized tokens, or disabling AuthGuardian authorization.
Immediately upgrade the Network-AI package to the patched version (5.15.5 or later).
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Network-AI to version 5.15.5 or higher, where input validation has been implemented. Run the appropriate command for your package manager:
# For npm users
npm install network-ai@5.15.5
# For yarn users
yarn upgrade network-ai@5.15.52. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, implement a middleware or validation layer to sanitize the id parameter before passing it to the vulnerable methods.
// Example middleware to block path traversal attempts in Node.js/Express
function sanitizeJobIdInput(req, res, next) {
const targetId = req.body.jobId || req.query.jobId;
if (targetId) {
// Reject payloads containing directory traversal sequences
const isTraversalAttempt = /[\/\\]|\.\./.test(targetId);
if (isTraversalAttempt) {
return res.status(400).json({ error: 'Access Denied: Invalid characters in Job ID.' });
}
}
next();
}3. Log Audit & IoC Verification Commands
Use the following commands to check your current package version and inspect application logs for potential exploitation attempts.
# 1. Audit logs for directory traversal patterns (e.g., ../, ..\, or URL-encoded equivalents)
grep -riE '\.\.\/|\.\.\\|\.\.%2f|\.\.%5cc' /var/log/network-ai/
# 2. Verify the currently installed version of network-ai
npm list network-aiScan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-120311) is a Path Traversal issue (CWE-23) residing within the FileJobStore component of the Network-AI framework. The root cause is the lack of proper input validation and sanitization on the id parameter before it is resolved into a file system path. This allows an attacker to inject directory traversal sequences (such as ../) to escape the designated job storage directory and access arbitrary .json files on the server.
2. Exploitation Mechanics & Attack Scenario
An attacker who controls the id parameter passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can exploit this vulnerability.
- Arbitrary File Read: By supplying an ID like
../../config/auth, the application resolves the path to../../config/auth.jsonand returns its contents, exposing sensitive credentials, API keys, or AuthGuardian tokens. - Arbitrary File Deletion: Triggering the
delete()method with a manipulated path allows the attacker to delete critical configuration.jsonfiles, leading to a Denial of Service (DoS) or weakening the AuthGuardian authorization framework by removing security policies.
3. Infrastructure & Business Impact
With a CVSS score of 8.8 (High), this vulnerability poses a severe threat to infrastructure security. Compromising AuthGuardian tokens or configuration files can lead to complete authorization bypass, allowing attackers to escalate privileges and move laterally within the network. Deletion of critical configuration files can also disrupt business operations and compromise data integrity.
Official Vendor Advisories & References
Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can disclose credentials and grant tokens or delete configuration files to weaken AuthGuardian authorization.
Frequently Asked SecOps Questions (CVE-2026-120311)
FAQQ1. How critical is CVE-2026-120311 and is it actively exploited in the wild?
CVE-2026-120311 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 0.4%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-120311?
Primary impacted vendors include jovancoding across network-ai. Scope summary: All Network-AI installations running versions 5.13.4 through 5.15.4
Q3. What temporary mitigations or workarounds exist for CVE-2026-120311 before patching?
[Mitigation] Immediately upgrade the Network-AI package to the patched version (5.15.5 or later). Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-120311
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (jovancoding)
View Category →Network-AI AgentVCR Path Traversal Vulnerability Leading to Arbitrary File Read/Write (CVE-2026-120312)
[Affected Scope] Network-AI versions from 5.13.4 before 5.15.5
Network-AI InputSanitizer Path Traversal Vulnerability (CVE-2026-120313) Technical Analysis and Mitigation Guide
[Affected Scope] Network-AI versions prior to 5.15.5
sevenz-rust2 Path Traversal and Arbitrary File Overwrite Vulnerability (CVE-2026-61725)
[Affected Scope] Rust applications utilizing sevenz-rust2 library versions prior to 0.21.1.
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.