Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-120311Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID

High 8.8

In plain English

A high-severity security flaw in Network-AI from Jovancoding. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 60.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can disclose credentials and grant tokens or delete configuration files to weaken AuthGuardian authorization.

Affected products (as reported)

Vendor	Product	Versions
Jovancoding	Network-AI	5.13.4 – before 5.15.5

Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-v64j-mc7x-c7x7) vendor-advisory
VulnCheck Advisory: Network-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID third-party-advisory