CVE-2026-120312

The record

Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save() to disclose sensitive JSON data or overwrite policy files such as AuthGuardian trust-level configuration.

Affected packages

Related vulnerabilities

• CVE-2026-63499 zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. CWE-23
• CVE-2026-116635 Improper limitation of a pathname to a restricted directory in the deployment status… CWE-23
• CVE-2026-120311 Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in… CWE-23
• CVE-2026-120307 The Beta9 worker serves the sandbox file API from outside the container. CWE-23
• CVE-2026-120225 A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. CWE-23
• CVE-2026-61725 sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. CWE-23
• CVE-2026-119553 Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through… CWE-23
• CVE-2026-107239 A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to… CWE-23