CVE-2026-120313

Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWi...