Network-AI EUVD-2026-46016

Exploitation requires local OS-level write access to the data/<env> directory of the target Network-AI environment - sufficient to create a symlink entry within it. This is the CVSS PR:L condition: any local user or process with write permission to that directory qualifies. The backup operation must subsequently execute, which can be triggered explicitly via the CLI or automatically as a side effect of promote or restore operations - no separate trigger privilege is needed if these operations run on a schedule or by other users. No special Network-AI configuration is required; the default installation is vulnerable. Exploitation is limited by: (1) the requirement for local filesystem write access to the environment data directory, typically meaning host or container shell access; (2) the attacker must also be able to read the resulting backup artifact directory to obtain exfiltrated files; and (3) exploitation cannot be performed remotely without first obtaining local access, ruling out unauthenticated network exploitation.

The NVD-assigned CVSS 3.1 score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N is consistent with the described exploitation conditions: local filesystem write access is required (AV:L), complexity is low once access is obtained (AC:L), and only low-privilege local access is needed (PR:L). Confidentiality impact is High (C:H) because arbitrary files outside the environment root - including sensitive system or application secrets - can be copied into backup artifacts accessible to the attacker. No EPSS score was provided in the input so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV, confirming no known active exploitation at time of analysis. However, a fully functional proof-of-concept is publicly disclosed in the GHSA advisory, which meaningfully lowers the bar for opportunistic exploitation by any local attacker. In multi-tenant or containerized deployments where multiple principals share write access to environment data directories, the realistic risk is elevated above what the raw CVSS score implies, since the local-access barrier may be shared among many users. The attack is not remotely exploitable without prior local access.

An attacker with local write access to a shared Network-AI environment data directory - for example, in a multi-tenant deployment or a container where several users access data/dev - creates a symlink inside data/dev pointing to /etc or another sensitive external directory. The next time any backup operation runs (triggered manually via network-ai env backup create --env dev or automatically during a promote or restore), the backup recursion follows the symlink and copies external files into data/dev/.backups/<backupId>/. The attacker then reads the backup artifact to access the exfiltrated files. A proof-of-concept demonstrating this exact sequence is included in GHSA-6x2m-p4xp-wg22.