CVE-2026-120311— Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID

Quick assessment

Affected

Jovancoding Network-AI

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Network-AI 5.13.4 至 5.15.5 之前的版本中，FileJobStore 组件存在路径遍历漏洞。攻击者通过在作业 ID 中提供遍历序列，可读取或删除任意的 .json 文件。若攻击者能够控制传递给 FileJobStore.get()、FileJobStore.delete() 或 JobQueue.getJob() 的 ID，则可能泄露凭证和授予令牌，或删除配置文件，从而削弱 AuthGuardian 的授权机制。

CVSS 8.8 · High Updated Nov 02, 2026

Possible ATT&CK Techniques 3 AI

T1562.001 T1583.006 · Web Services T1552.001 · Credentials In Files

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID

Source: CVE Program / CVE List V5

Vulnerability Description

Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can disclose credentials and grant tokens or delete configuration files to weaken AuthGuardian authorization.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

相对路径遍历

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Jovancoding	Network-AI	5.13.4 ~ 5.15.5	-

II. Public POCs for CVE-2026-120311

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120311

请登录查看更多情报信息。

Other References for CVE-2026-120311 (2)

https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-v64j-mc7x-c7x7 vendor-advisory
https://www.vulncheck.com/advisories/network-ai-5.13.4-before-5.15.5-path-traversal-via-filejobstore-job-id third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120311

Same Patch Batch · Jovancoding · 2026-11-02 · 4 CVEs total

CVE-2026-120312	8.8 HIGH	Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Name
CVE-2026-120313	7.5 HIGH	Network-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePath
CVE-2026-120314	7.3 HIGH	Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations

IV. Related Vulnerabilities

Same product: Network-AI

Same vendor: Jovancoding

Same weakness: CWE-23