CVE-2026-120311

Network-AI job IDs can escape the job store

Jovancoding · Network-AI FileJobStore and JobQueue

First documented disclosure · Review checkpoint

Summary

An attacker-controlled job identifier can read or delete JSON files outside the job directory.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: Controlled researcher evidence; the reviewed primary sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Lookup and deletion join the supplied identifier and a .json suffix to the configured directory without containment validation. Safe identifiers generated during job creation do not protect separate lookup methods.

Conditions required

A consuming application lets an attacker influence the identifier passed to FileJobStore.get/delete or JobQueue.getJob. Files must be reachable within the process permissions and resolve to a .json suffix.

Potential impact

JSON configuration, credentials or grants can be disclosed or deleted. Deleting restrictive authorization state can trigger weaker defaults; no remote code execution was demonstrated.

Affected versions and configurations

Network-AI 5.13.4 through 5.15.4.

Fix and mitigation status

5.15.5 adds safeChildPath validation for this issue; use a current supported fixed release.

Practical next steps

Upgrade, restrict job identifiers and process filesystem access, and examine job-lookup exposure. Keep grant and policy files outside writable job-data authority.

Operating lesson

Creation-time identifier safety does not secure later lookup and deletion APIs.

Evidence and limits

Public advisory and fix release October 17; CVE November 2. The original report’s “not fixed” paragraph is stale: its package table, maintainer release and CNA all name 5.15.5. CNA High 8.7 CVSS 4.0; maintainer 8.8 v3.1. CNA explicitly maps the GHSA despite its stale “No known CVE” field.

Sources