CVE-2026-120311

The record

Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can disclose credentials and grant tokens or delete configuration files to weaken AuthGuardian authorization.

Affected packages

Related vulnerabilities

• CVE-2026-63499 zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. CWE-23
• CVE-2026-116635 Improper limitation of a pathname to a restricted directory in the deployment status… CWE-23
• CVE-2026-120312 Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR… CWE-23
• CVE-2026-120307 The Beta9 worker serves the sandbox file API from outside the container. CWE-23
• CVE-2026-120225 A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. CWE-23
• CVE-2026-61725 sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. CWE-23
• CVE-2026-119553 Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through… CWE-23
• CVE-2026-107239 A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to… CWE-23