Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-120311: Network-AI can let attackers read or delete JSON files
CVE-2026-120311 · published 1 day ago
Summary
Versions of Network-AI from 5.13.4 up to 5.15.4 let a malicious user supply a specially crafted job ID to read or remove any .json file on the system. This could expose credentials, tokens, or configuration data and weaken authentication controls. Update to version 5.15.5 or later, or apply a patch that validates job IDs, to stop the issue.
What to do
- Update jovancoding network-ai to version 5.15.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| jovancoding | network-ai | < 5.15.5 |
Original advisory text
Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID
Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can disclose credentials and grant tokens or delete configuration files to weaken AuthGuardian authorization.
References
- https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-v64j-mc7x-c7x... Vendor Advisory
- https://www.vulncheck.com/advisories/network-ai-5.13.4-before-5.15.5-path-traver... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-1203... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-120311 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-23Relative Path Traversal
Timeline
Published2 Nov 2026
Updated3 Nov 2026
First seen2 Nov 2026
Sources
CVE-2026-120311 · NVD
CVE-2026-120311 · MITRE
CVE-2026-120311 · OSV
GHSA-v64j-mc7x-c7x7 · GHSA
Track software like this
Free during beta