CVE-2026-58413: Network-AI Path Traversal Vulnerability

CVE-2026-58413 Overview

CVE-2026-58413 is a path traversal vulnerability [CWE-22] in Network-AI, a TypeScript/Node.js multi-agent orchestrator for Claude Code. Versions prior to 5.12.2 fail to validate the backupId parameter in EnvironmentManager.restore(env, backupId). A local caller can supply a traversal value such as ../../../outside/source-dir to copy arbitrary directories into the target environment data directory. The flaw enables unauthorized file restoration from locations outside the intended .backups/ directory, corrupting environment state with attacker-chosen content.

Critical Impact
Local authenticated users can restore arbitrary filesystem directories into Network-AI environment data, breaking data integrity and enabling injection of untrusted content into agent workflows.

Affected Products

Network-AI (Jovancoding/Network-AI) versions prior to 5.12.2
OpenClaw Community network-ai plugin for Claude Code prior to 5.12.2
Deployments using EnvironmentManager.restore() for backup handling

Discovery Timeline

2026-07-20 - CVE-2026-58413 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-58413

Vulnerability Analysis

The vulnerability resides in the EnvironmentManager.restore(env, backupId) function within Network-AI. The function constructs a backup path using join(envDir, '.backups', backupId) and verifies only that the resulting path exists on disk. It does not resolve the joined path or confirm that it stays within the intended data/<env>/.backups directory.

Because Node.js path.join() normalizes .. segments without enforcing containment, a backupId value such as ../../../outside/source-dir escapes the backups directory. The restore operation then copies files from an attacker-controlled location into the target environment. This corrupts environment data and can plant untrusted files consumed by downstream multi-agent orchestration logic.

Root Cause

The root cause is missing path canonicalization and containment validation on untrusted input. The backupId parameter is treated as an opaque identifier but is used directly in filesystem path construction. Without resolve() and prefix checks, the code permits directory traversal sequences to alter the final path outside its intended parent.

Attack Vector

Exploitation requires local access with permission to invoke EnvironmentManager.restore() with an attacker-chosen backupId. The attacker supplies a crafted identifier containing path separators or .. sequences. The function then reads files from an arbitrary directory readable by the Network-AI process and writes them into the environment data directory.

text

// Patch metadata from marketplace.json / plugin.json
-      "version": "5.12.1",
+      "version": "5.12.2",

// Fixed validation logic (per advisory GHSA-48x2-6pr9-2jjf):
// backupId must match /^[\w\-]+$/
// dirname(resolve(join(backupsDir, backupId))) === resolve(backupsDir)

Source: GitHub Commit a59c13a

Detection Methods for CVE-2026-58413

Indicators of Compromise

Unexpected files or directory structures appearing under data/<env>/ that do not correspond to legitimate backup snapshots
Audit log entries showing restore() calls with backupId values containing .., /, or \ characters
Network-AI package version reporting 5.12.1 or earlier in .claude-plugin/plugin.json or marketplace.json

Detection Strategies

Inspect Network-AI append-only audit logs for restore operations with malformed backupId values
Scan installed Network-AI deployments for versions less than 5.12.2 using package manifest checks
Enable filesystem integrity monitoring on data/<env>/ directories to flag unexpected file writes originating from the orchestrator process

Monitoring Recommendations

Forward Network-AI orchestrator logs and process filesystem telemetry to a centralized analytics platform for correlation
Alert on any invocation of EnvironmentManager.restore() where the backupId argument fails a ^[\w\-]+$ character-class check
Track child-process file reads outside the expected .backups/ tree for the Node.js runtime hosting Network-AI

How to Mitigate CVE-2026-58413

Immediate Actions Required

Upgrade Network-AI to version 5.12.2 or later in all environments, including development, staging, and production
Audit historical restore operations for suspicious backupId values and validate environment data integrity against known-good snapshots
Restrict local access to systems running Network-AI so only trusted operators can invoke restore operations

Patch Information

The fix is available in Network-AI v5.12.2. The patched restore() validates backupId against the regular expression /^[\w\-]+$/ and asserts dirname(resolve(join(backupsDir, backupId))) === resolve(backupsDir) before performing any filesystem operation. Identifiers containing path separators or .. are rejected. Refer to the GitHub Security Advisory GHSA-48x2-6pr9-2jjf and Release v5.12.2 for full details.

Workarounds

If immediate upgrade is not possible, wrap calls to EnvironmentManager.restore() with input validation rejecting any backupId containing /, \, or ..
Run the Network-AI process under a dedicated low-privilege user with filesystem access limited to its environment data directory
Disable or gate the restore code path through permission checks until the patched version is deployed

bash

# Upgrade Network-AI to the patched release
npm install network-ai@5.12.2

# Verify installed version
npm ls network-ai

# Confirm plugin manifest reports the fixed version
grep '"version"' .claude-plugin/plugin.json