# CVE-2026-58484: Jovancoding Network-AI arbitrary file deletion in EnvironmentManager

Source: https://junglewise.ai/threats/cve-2026-58484-jovancoding-network-ai-arbitrary-file-deletion-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-58484 · Severity: high · CVSS 7.1 · Published 2026-07-20

Network-AI is a multi-agent coordination framework used to manage shared state and orchestrate AI agents. A vulnerability in the backup pruning feature allows an attacker with write access to the data directory to craft a malicious backup manifest that causes arbitrary recursive deletion of files and directories accessible to the Network-AI process. This results in data loss and denial of service when backups are pruned.

Technologies: [Jovancoding Network-AI](https://junglewise.ai/threats/technologies/network-ai). Vendors: [Jovancoding](https://junglewise.ai/threats/vendors/jovancoding).

## Quick answers

**Is CVE-2026-58484 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58484 being exploited in the wild.

**How severe is CVE-2026-58484?** High severity, with a CVSS score of 7.1, published 20 July 2026.

**Which products and versions are affected?** Jovancoding Network-AI < 5.12.2, <=5.12.1.

**Is there a fix for CVE-2026-58484?** A patch was published on 2026-06-18: Fixed in v5.12.2 (commit a59c13a) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58484 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-58484?** Check whether you run Jovancoding Network-AI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal flaw (CWE-22, CWE-73) in Network-AI's backup pruning mechanism. The EnvironmentManager.listBackups() function reads backup manifest files (_manifest.json) from disk without validation and trusts the 'path' field within them. The pruneBackups() function later uses this attacker-controlled path directly in rmSync(entry.path, { recursive: true, force: true }), enabling recursive deletion of arbitrary directories. An attacker with write access to data/&lt;env&gt;/.backups/&lt;name&gt;/_manifest.json can inject a malicious path (e.g., "/" or any filesystem location accessible to the Network-AI process user) to cause data destruction when the CLI command 'network-ai env backup prune --env &lt;env&gt; --keep &lt;n&gt;' is executed. The fix in v5.12.2 recomputes the deletion path from a validated backupId and enforces a dirname containment check, preventing traversal outside the backups directory.

## Affected products

- Jovancoding Network-AI <=5.12.1

## Identifiers

- CVE-2026-58484
- GHSA-2fmp-9rvw-hc96

## Timeline

- 2026-06-19: disclosed
- 2026-06-18: patched: Fixed in v5.12.2 (commit a59c13a)

## References

- [https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-2fmp-9rvw-hc96](https://github.com/Jovancoding/Network-AI/security/advisories/GHSA-2fmp-9rvw-hc96)
- [https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3](https://github.com/Jovancoding/Network-AI/commit/a59c13a1f0ce0e8a0779a90343eef92fac5ab4c3)
- [https://github.com/Jovancoding/Network-AI](https://github.com/Jovancoding/Network-AI)
- [https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2](https://github.com/Jovancoding/Network-AI/releases/tag/v5.12.2)

## Related threats

- [Network-AI A2AServer missing authentication in task operations](https://junglewise.ai/threats/cve-2026-120314-network-ai-from-5-14-0-before-5-15-5-contains-a-missing)
- [Network-AI path traversal in InputSanitizer.sanitizePath](https://junglewise.ai/threats/cve-2026-120313-network-ai-before-5-15-5-contains-a-path-traversal-vulnerability)
- [Network-AI AgentVCR path traversal in cassette name](https://junglewise.ai/threats/cve-2026-120312-network-ai-from-5-13-4-before-5-15-5-contains-a-path-traversal)
- [Network-AI FileJobStore path traversal in job ID handling](https://junglewise.ai/threats/cve-2026-120311-network-ai-from-5-13-4-before-5-15-5-contains-a-path-traversal)
- [Network-AI security control bypass in ClaudeHookBridge](https://junglewise.ai/threats/cve-2026-109331-network-ai-from-5-14-0-before-5-15-2-contains-a-security-control)