CVE-2026-120312— Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Name

Quick assessment

Affected

Jovancoding Network-AI

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Network-AI 5.13.4 至 5.15.5 之前的版本中，AgentVCR 组件存在路径遍历漏洞。攻击者若能够控制磁带（cassette）名称，即可读取或写入任意文件。攻击者可通过向或函数传递路径遍历序列，从而泄露敏感的 JSON 数据，或覆盖策略文件（例如 AuthGuardian 的信任级别配置文件）。

CVSS 8.8 · High Updated Nov 02, 2026

Possible ATT&CK Techniques 2 AI

T1083 · File and Directory Discovery T1565.003 · Runtime Data Manipulation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Name

Source: CVE Program / CVE List V5

Vulnerability Description

Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save() to disclose sensitive JSON data or overwrite policy files such as AuthGuardian trust-level configuration.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

相对路径遍历

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Jovancoding	Network-AI	5.13.4 ~ 5.15.5	-

II. Public POCs for CVE-2026-120312

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120312

请登录查看更多情报信息。

Other References for CVE-2026-120312 (2)

https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mfxv-jg44-xj48 vendor-advisory
https://www.vulncheck.com/advisories/network-ai-5.13.4-before-5.15.5-path-traversal-via-agentvcr-cassette-name third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120312

Same Patch Batch · Jovancoding · 2026-11-02 · 4 CVEs total

CVE-2026-120311	8.8 HIGH	Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID
CVE-2026-120313	7.5 HIGH	Network-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePath
CVE-2026-120314	7.3 HIGH	Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations

IV. Related Vulnerabilities

Same product: Network-AI

Same vendor: Jovancoding

Same weakness: CWE-23