CVE-2026-35482

HighCVSS 8.0

Published: 02/06/2026(UTC)Updated: 12/08/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

21th percentile - higher than 21% of all known CVEs

Summary

A sandbox escape vulnerability in alf.io, an open source ticket reservation system, allows an authenticated administrator to execute arbitrary OS commands on the server via the extension mechanism.

Risk Assessment

An attacker administrator could fully compromise the server, leading to loss of confidentiality, integrity, and availability of data.

Recommendation

Update alf.io to version 2.0-M5-2606 or later, which contains the fix.

Other vulnerabilities in alf.io

CVE-2026-41412Medium
Vulnerability in alf.io before version 2.0-M5-2606: the extension sandbox injects an HTTP client (`simpleHttpClient`) into scripts. The `postFileAndSaveResponse()` method accepts arbitrary file paths without validation, allowing malicious scripts to read and exfiltrate any file to an attacker-controlled server.

Original NVD description (English source)

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environment; however, a combination of an unguarded injected Java object (`returnClass`) and an incomplete AST blocklist allows the sandbox to be fully escaped using Java reflection without triggering any validation errors. Version 2.0-M5-2606 patches the issue.