PT-2026-45879 · Alf.Io · Alf.Io

Devnoscope · CVE-2026-35482 · Published 2026-06-02 · Updated 2026-07-07

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions alf.io versions prior to 2.0-M5-2606

Description A sandbox escape issue exists in the extension script engine of alf.io, an open source ticket reservation system. An authenticated administrator can execute arbitrary operating system commands on the server. The system uses a sandboxed Rhino environment to execute restricted JavaScript; however, an incomplete AST (Abstract Syntax Tree) blocklist and an unguarded injected Java object returnClass allow the sandbox to be bypassed using Java reflection. This flaw can be triggered through the Extensions API.

Recommendations Update to version 2.0-M5-2606.

Exploit

Fix

RCE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-35482

GHSA-3W8F-MCF6-CM7H

Affected Products

Alf.Io

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35482.json · Exploit
• 🔥 https://github.com/alfio-event/alf.io/security/advisories/GHSA-3w8f-mcf6-cm7h · Exploit
• https://osv.dev/vulnerability/CVE-2026-35482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35482 · Security Note
• https://t.me/CVEtracker/55673 · Telegram Post
• https://twitter.com/trynoscope/status/2062514208252526647 · Twitter Post
• https://twitter.com/trynoscope/status/2074554390984175871 · Twitter Post
• https://twitter.com/CVEnew/status/2061993197505515978 · Twitter Post
• https://twitter.com/NapaCorruption/status/2074249531282039172 · Twitter Post
• https://twitter.com/trynoscope/status/2072750201194922337 · Twitter Post
• https://twitter.com/trynoscope/status/2062514179655835706 · Twitter Post
• https://twitter.com/sudosheggs/status/2073131109928313176 · Twitter Post