CVE-2026-35482
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A sandbox escape vulnerability in alf.io, an open source ticket reservation system, allows an authenticated administrator to execute arbitrary OS commands on the server via the extension mechanism.
Risk Assessment
An attacker administrator could fully compromise the server, leading to loss of confidentiality, integrity, and availability of data.
Recommendation
Update alf.io to version 2.0-M5-2606 or later, which contains the fix.
Other vulnerabilities in alf.io
See all- CVE-2026-50165High
In alf.io before version 2.0-M5-2605, an improper access control issue allows an organization owner to read system-level configuration secrets through organization/event scoped 'single configuration' endpoints, including the system API key.
- CVE-2026-41412Medium
Vulnerability in alf.io before version 2.0-M5-2606: the extension sandbox injects an HTTP client (`simpleHttpClient`) into scripts. The `postFileAndSaveResponse()` method accepts arbitrary file paths without validation, allowing malicious scripts to read and exfiltrate any file to an attacker-controlled server.
Original NVD description (English source)
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environment; however, a combination of an unguarded injected Java object (`returnClass`) and an incomplete AST blocklist allows the sandbox to be fully escaped using Java reflection without triggering any validation errors. Version 2.0-M5-2606 patches the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS