Network‑AI versions 5.13.4 through 5.15.4 contain a path‑traversal flaw in the FileJobStore module that allows an attacker controlling the job identifier to read or delete arbitrary .json files from the file system. These files may contain stored credentials, grant tokens, or configuration data. Exploiting the flaw can reveal authentication secrets and, if the attacker deletes critical configuration files, can weaken AuthGuardian’s authorization checks, effectively elevating privileges or disrupting service.

The affected vendor is Jovancoding, product Network‑AI. All builds from 5.13.4 up to but excluding 5.15.5 are vulnerable. Versions 5.15.5 and any later releases contain the fix.

With a CVSS score of 8.7 the vulnerability is considered high severity. No EPSS score is available, but the absence of a KEV listing does not diminish its exploitability. The likely attack vector is an attacker able to submit a crafted job identifier—potentially via an exposed API or management interface—thereby enabling directory traversal to arbitrary .json files on the host. The impact can be significant if sensitive credentials or configuration files are accessed or removed.