Network-AI: EnvironmentManager.restore() backup ID path traversal copies arbitrary directories into environment data
Date: 2026-06
Affected: npm/network-ai
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CWE: CWE-22
CWE-23
CWE-352
CWE-59
CWE-73
CWE-862
CVSS: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)

### Summary `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and only checks that this path exists. It does not resolve the result or verify that it remains under `data/<env>/.backups`. A caller can pass a traversal backup ID such as `../../../outside/source-dir` to restore files from an arbitrary directory into the target environment data directory. Confirmed in Network-AI 5.12.1. ### Details `restore()` builds `backupPath` directly from caller-controlled `backupId`: ```ts restore(env: EnvName, backupId: string): RestoreResult { const envDir = this.getDataDir(env); const backupsDir = join(envDir, '.backups'); const backupPath = join(backupsDir, backupId); if (!existsSync(backupPath)) { throw new Error(`Backup '${backupId}' not found for environment '${env}'`); } this.backup(env); const files = this._collectBackupFiles(backupPath); let restored = 0; for (const rel of files) { if (rel === '_manifest.json') continue; const src = join(backupPath, rel); const dst = join(envDir, rel); try { mkdirSync(join(envDir, rel.includes('/') ? rel.substring(0, rel.lastIndexOf('/')) : '.'), { recursive: true }); copyFileSync(src, dst); restored++; } catch { /* skip */ } } return { backupId, env, filesRestored: restored }; } ``` There is no resolved containment check that ensures `backupPath` remains under `backupsDir`. Default CLI reachability exists through `


Mitigations:

Architectural layers (MAESTRO):