Path Traversal Vulnerability in Network-AI Multi-Agent Orchestrator

CVE-2026-58484

What is CVE-2026-58484?

The Network-AI orchestrator prior to version 5.12.2 has a path traversal vulnerability where the EnvironmentManager.listBackups() function improperly trusts the path field in backup manifests. This oversight allows attackers to leverage a malicious manifest within data/<env>/.backups/<name>/_manifest.json to execute pruneBackups(), potentially leading to the recursive deletion of arbitrary paths on the system. Version 5.12.2 mitigates this risk by no longer trusting the entry.path from the manifest. Instead, it validates the deletion path, ensuring it remains confined under the backups directory.

References