The flaw resides in the EnvironmentManager.restore() function, which builds a backup path by joining the environment directory with the supplied backupId but fails to resolve or constrain that path. An attacker can provide a traversal string such as ../../../outside/source-dir, causing the orchestrator to copy files from arbitrary locations on the host into the target environment’s data directory. This results in unauthorized overwriting of data that may contain credentials or configuration, jeopardizing confidentiality and integrity of the environment.

Jovancoding Network-AI versions earlier than 5.12.2 are affected. The vulnerability is present in the TypeScript/Node.js multi‑agent orchestrator before the release that introduces validation of the backupId. Any deployment running these versions with untrusted users able to call restore() is vulnerable.

The national CVSS score of 6.1 indicates a moderate severity vulnerability. The EPSS score is < 1%, indicating a very low but nonzero likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires the ability to invoke restore() with a crafted backupId, which suggests the attack originates from a privileged API or local process that can interact with the orchestrator. If such access is achieved, the attacker can redirect file copying operations to arbitrary directories, potentially overwriting critical data without authentication checks.