---
id: CVE-2026-120312
title: Network-AI 5.13.4 before 5.15.5 Path Traversal via AgentVCR Cassette Name
summary: >-
  Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability
  in AgentVCR that allows attackers controlling the cassette name to read or
  write arbitrary .json files. Attackers can pass traversal sequences to load()
  or save…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-23
vendor: Jovancoding
product: Network-AI
affected:
  - Network-AI >= 5.13.4 < 5.15.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-02T17:09:52.810484Z'
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:39:06.709Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120312'
references:
  - url: >-
      https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-mfxv-jg44-xj48
    label: GitHub Security Advisory (GHSA-mfxv-jg44-xj48)
  - url: >-
      https://www.vulncheck.com/advisories/network-ai-5.13.4-before-5.15.5-path-traversal-via-agentvcr-cassette-name
    label: >-
      VulnCheck Advisory: Network-AI 5.13.4 before 5.15.5 Path Traversal via
      AgentVCR Cassette Name
tags:
  - cve.org
epss: 0.00448
epssPercentile: 0.39158
ingestedAt: '2026-11-05T19:30:42.740Z'
---

## Overview

Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save() to disclose sensitive JSON data or overwrite policy files such as AuthGuardian trust-level configuration.

## Affected

- `Network-AI >= 5.13.4 < 5.15.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.