js · network-aiHeads-up
Network-AI: Path Traversal in EnvironmentManager.restore()
EnvironmentManager.restore() in Network-AI before 5.12.2 does not validate backupId, allowing path traversal to copy arbitrary directories into data/<env>.
What changed
EnvironmentManager.restore() in Network-AI before 5.12.2 does not validate backupId, allowing path traversal to copy arbitrary directories into data/<env>.
Who it affects
Users of Network-AI <=5.12.1 who expose the backup restore functionality (e.g., via CLI).
What to do today
Upgrade to [email protected] or later immediately.
The trail
Collected→
Audited→
Written→
Published