Threats tagged 'ghsa-jw39-vgr6-2fx4'

Network-AI versions prior to 5.15.5 have a path traversal vulnerability in the InputSanitizer.sanitizePath() function. This flaw allows attackers to escape the intended base directory by using sibling-directory paths that share a string prefix with the base directory. The vulnerability arises because the check to prevent directory traversal uses an unanchored startsWith method, which can be bypassed. Exploitation could allow attackers to read, list, or write files outside the sandboxed environment.