Description
Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jovancoding | Network-AI | < 5.15.5 | 5.15.5 |
References
- GitHub Security Advisory (GHSA-5mm5-4mh4-6gm6) vendor-advisory
- VulnCheck Advisory: Network-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePath third-party-advisory