GHSA-48x2-6pr9-2jjf

### Summary `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and only checks that this path exists. It does not resolve the result or verify that it remains under `data/<env>/.backups`. A caller can pass a traversal backup ID such as `../../../outside/source-dir` to restore files from an arbitrary directory into the target environment data directory. Confirmed in Network-AI 5.12.1. ### Details `restore()` builds `backupPath` directly from caller-controlled `backupId`: ```ts restore(env: EnvName, backupId: string): RestoreResult { const envDir = this.getDataDir(env); const backupsDir = join(envDir, '.backups'); const backupPath = join(backupsDir, backupId); if (!existsSync(backupPath)) { throw new Error(`Backup '${backupId}' not found for environment '${env}'`); } this.backup(env); const files = this._collectBackupFiles(backupPath); let restored = 0; for (const rel of files) { if (rel === '_manifest.json') continue; const src = join(backupPath, rel); const dst = join(envDir, rel); try { mkdirSync(join(envDir, rel.includes('/') ? rel.substring(0, rel.lastIndexOf('/')) : '.'), { recursive: true }); copyFileSync(src, dst); restored++; } catch { /* skip */ } } return { backupId, env, filesRestored: restored }; } ``` There is no resolved containment check that ensures `backupPath` remains under `backupsDir`. Default CLI reachability exists through `network-ai env backup restore --env <env> --backup <id>`. Affected source evidence: - `lib/env-manager.ts:474-499` — vulnerable restore path construction and copy. - `bin/cli.ts:441-458` — default CLI exposes restore with caller-controlled `--backup`. ### PoC This PoC uses only temporary directories and restores `trust_levels.json` from an external directory into `data/dev`: ```bash TMP=$(mktemp -d) TMPBASE="$TMP" node -r ts-node/register/transpile-only - <<'TS' const { EnvironmentManager }