Network‑AI versions prior to 5.15.5 contain a path traversal flaw in the AgentVCR component that allows an attacker who can influence the cassette name to access or modify any .json file on the host. The vulnerability can be used to disclose sensitive configuration data or to overwrite policy files such as the AuthGuardian trust‑level configuration, potentially compromising authentication decisions.

The affected product is Network‑AI from Jovancoding. Versions 5.13.4 through 5.15.4 are vulnerable. The product versioning stops at 5.15.5, which addresses the flaw.

The CVSS score of 8.7 classifies the issue as High severity. The EPSS score is not available, so the exact likelihood of exploitation is unknown, but the fact that the vulnerability allows arbitrary file read/write raises immediate concern. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the AgentVCR interface where an attacker can provide a malicious cassette name to trigger the traversal – this could be achieved through the public API or console interface, depending on exposure.