Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and only checks that this path exists. It does not resolve the result or verify that it remains under `data/<env>/.backups`. A caller can pass a traversal backup ID such as `../../../outside/source-dir` to restore files from an arbitrary directory into the target environment data directory. The issue is fixed in v5.12.2. `restore()` now validates `backupId` against `/^[\w\-]+$/` and asserts `dirname(resolve(join(backupsDir, backupId))) === resolve(backupsDir)` before touching the filesystem. Backup IDs containing path separators or `..` are rejected, so a crafted ID can no longer copy directories from outside `.backups/` into the environment.

Affected: npm: network-ai

### Summary `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and only checks that this path exists. It does not resolve the result or verify that it remains under `data/<env>/.backups`.

A caller can pass a traversal backup ID such as `../../../outside/source-dir` to restore files from an arbitrary directory into the target environment data directory. Confirmed in Network-AI 5.12.1.

### Details `restore()` builds `backupPath` directly from caller-controlled `backupId`:

```ts restore(env: EnvName, backupId: string): RestoreResult { const envDir = this.getDataDir(env); const backupsDir = join(envDir, '.backups'); const backupPath = join(backupsDir, backupId);

if (!existsSync(backupPath)) { throw new Error(`Backup '${backupId}' not found for environment '${env}'`); }

this.backup(env);

const files = this._collectBackupFiles(backupPath); let restored = 0; for (const rel of files) { if (rel === '_manifest.json') continue; const src = join(backupPath, rel); const dst = join(envDir, rel); try { mkdirSync(join(envDir, rel.includes('/') ? rel.substring(0, rel.lastIndexOf('/')) : '.'), { recursive: true }); copyFileSync(src, dst); restored++; } catch { /* skip */ } }

return { backupId, env, filesRestored: restored }; } ```

There is no resolved containment check that ensures `backupPath` remains under `backupsDir`.

Default CLI reachability exists through…