PT-2026-45881 · Alf.Io · Alf.Io

Et43 · Published 2026-06-02 · Updated 2026-06-03 · CVE-2026-41412

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions alf.io versions prior to 2.0-M5-2606

Description The extension sandbox injects a fully-functional HTTP client (simpleHttpClient) into every extension script's scope. The postFileAndSaveResponse() method accepts an arbitrary filesystem path via the file parameter and reads the file contents using new FileInputStream(file) without path validation, directory restriction, or an allowlist. This allows a malicious extension script to read any file accessible to the JVM process user and exfiltrate the data to an external server via HTTP POST.

Recommendations Update to version 2.0-M5-2606.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

CWE-73

Related Identifiers

CVE-2026-41412

Affected Products

Alf.Io

References · 4

• 🔥 https://github.com/alfio-event/alf.io/security/advisories/GHSA-6m62-53cw-4373 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41412 · Security Note
• https://twitter.com/CVEnew/status/2061993196276633693 · Twitter Post
• https://t.me/CVEtracker/55675 · Telegram Post