Network‑AI prior to version 5.15.5 contains a path traversal flaw in the InputSanitizer.sanitizePath method. The flaw permits an attacker to craft paths that include sibling directory references, bypassing a prefix check on the base directory. As a result, an attacker can read, list, or write files outside the sandbox. This exposes the file system to unauthorized disclosure, modification, and potentially the execution of malicious code if configuration or executable files are altered. The weakness is a classic directory traversal (CWE‑22), which directly compromises confidentiality, integrity, and availability at the filesystem level.

The affected product is Jovancoding Network‑AI, versions earlier than 5.15.5. No additional specific sub‑versions are listed, so all releases before 5.15.5 should be considered vulnerable.

The CVSS score of 8.7 indicates a high‑severity vulnerability. EPSS data is unavailable, so the exact exploitation probability is unknown, but the flaw is easily triggered by supplying a malicious path argument, which can be done remotely through any interface that invokes sanitizePath. The vulnerability is not listed in CISA’s KEV catalog, yet its high score and public disclosure on GitHub and community advisories suggest attackers could quickly monetize it. If the application accepts user‑supplied paths from untrusted domains or IP addresses, the risk escalates to a real exploitation threat.