{"id":"CVE-2026-120312","published":"2026-11-02T03:17:28.863","lastModified":"2026-11-02T03:17:28.997","description":"Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save() to disclose sensitive JSON data or overwrite policy files such as AuthGuardian trust-level configuration.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-23"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mfxv-jg44-xj48","tags":[]},{"url":"https://www.vulncheck.com/advisories/network-ai-5.13.4-before-5.15.5-path-traversal-via-agentvcr-cassette-name","tags":[]}],"exploitRefs":[{"url":"https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mfxv-jg44-xj48","tags":[]}],"hasPoc":true,"ai":{"summary":"A path traversal flaw in AgentVCR (part of Network-AI 5.13.4–5.15.4) lets authenticated attackers with control over cassette names read or write arbitrary .json files by injecting traversal sequences into load() or save() calls.","exploitability":"Exploitation requires valid low-privilege credentials and the ability to influence the cassette name parameter passed to AgentVCR’s load() or save() functions.","blast_radius":"Successful exploitation could expose sensitive JSON data (e.g., credentials, internal configs) or overwrite critical policy files like AuthGuardian trust-level settings, potentially enabling privilege escalation or authentication bypass.","remediation":"Upgrade Network-AI to version 5.15.5 or later, which patches the path traversal vulnerability in AgentVCR.","detection":"Defenders should monitor for unusual file access patterns to .json files outside expected directories in AgentVCR logs, especially requests containing sequences like ../ or %2e%2e/ in cassette name parameters.","tags":["path-traversal","auth-bypass","file-read","file-write","json"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:56:14.745Z"}}