Network-AI versions before 5.12.2 contain a path traversal vulnerability (CWE-22) in the EnvironmentManager.pruneBackups() function. This function reads backup manifest files and uses the manifest's path field directly in a recursive deletion call (rmSync). An attacker able to place or modify a manifest file can cause arbitrary recursive deletion of files and directories accessible to the Network-AI process user. The vulnerability is addressed in version 5.12.2 by recomputing deletion paths from validated backup IDs and enforcing directory containment checks, preventing deletion outside the intended backup directory.

An attacker with the ability to place or modify backup manifest files can cause the Network-AI process to recursively delete arbitrary files or directories on the host system. This results in high impact on integrity and availability of the affected system. There is no confidentiality impact reported. The vulnerability requires local privileges (low attack complexity and privileges) and no user interaction.

A fix is available in Network-AI version 5.12.2. Users should upgrade to version 5.12.2 or later to mitigate this vulnerability. The fix involves validating and restricting deletion paths to prevent arbitrary file system deletion. Until upgraded, restrict access to backup manifest files to trusted users only. Patch status is not explicitly stated beyond the fixed version; check the vendor advisory for the latest remediation guidance.