PT-2026-61658 · Unknown · Network-Ai

CVE-2026-58484 · Published 2026-06-19 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Network-AI versions prior to 5.12.2

Description An issue exists where EnvironmentManager.listBackups() reads the manifest.json file of backups and trusts the path field. Subsequently, EnvironmentManager.pruneBackups() passes this path value directly to the rmSync() function. An attacker capable of modifying or placing a manifest file within data/<env>/.backups/<name>/ manifest.json can trigger the recursive deletion of any arbitrary path accessible to the user running the Network-AI process by invoking the pruneBackups() function or the network-ai env backup prune --env <env> --keep <n> command.

Recommendations Update to version 5.12.2.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-73

Related Identifiers

CVE-2026-58484

GHSA-2FMP-9RVW-HC96

Affected Products

Network-Ai

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58484.json · Exploit
• 🔥 https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-2fmp-9rvw-hc96 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-58484 · Security Note
• https://osv.dev/vulnerability/GHSA-2fmp-9rvw-hc96 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-58484 · Vendor Advisory
• https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3 · Note
• https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2 · Note
• https://github.com/Jovancoding/Network-AI · Note