CVE-2026-120313
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 02, 2026
Vendor
unknown
Description
Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.