Cve-2026-120314 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-120314/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 05:17:32 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgNetwork-AI: Path traversal in InputSanitizer (CVE-2026-120313)https://feed.craftedsignal.io/briefs/2026-11-network-ai-path-traversal-9c1f04f0/Mon, 02 Nov 2026 05:17:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-network-ai-path-traversal-9c1f04f0/Network-AI versions prior to 5.15.5 contain a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory via sibling-directory paths.Network-AI versions prior to 5.15.5 are susceptible to a path traversal vulnerability located in the InputSanitizer.sanitizePath() function. The vulnerability arises from an unanchored "startsWith" check used during input validation. By providing a sibling-directory path that shares a string prefix with the intended base directory, an attacker can bypass these checks to access, list, or write files outside of the configured sandbox.

Impact

Unauthorized access allows attackers to read, list, or write files on the host filesystem that are outside of the restricted sandbox directory.

Recommendation

  • Upgrade Network-AI to version 5.15.5 or later.
  • Implement strict input validation or use established path-canonicalization libraries that do not rely on unanchored prefix comparisons for path isolation.
  • Audit file system access logs for operations targeting directories outside of the designated application storage path.
]]>highadvisorypath-traversalvulnerabilityauthentication-bypasscve-2026-120314webserver