CVE-2026-41412
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Vulnerability in alf.io before version 2.0-M5-2606: the extension sandbox injects an HTTP client (`simpleHttpClient`) into scripts. The `postFileAndSaveResponse()` method accepts arbitrary file paths without validation, allowing malicious scripts to read and exfiltrate any file to an attacker-controlled server.
Risk Assessment
The risk involves potential exfiltration of sensitive system or application files, leading to confidentiality and integrity breaches.
Recommendation
Immediately update alf.io to version 2.0-M5-2606 or later and restrict access to extension scripts.
Other vulnerabilities in alf.io
Original NVD description (English source)
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, the alf.io extension sandbox injects a fully-functional HTTP client (`simpleHttpClient`) into every extension script's scope. The `postFileAndSaveResponse()` method accepts an arbitrary filesystem path as its `file` parameter and reads the file contents using `new FileInputStream(file)` with no path validation, directory restriction, or allowlist. A malicious extension script can read any file accessible to the JVM process user and exfiltrate it to an attacker-controlled server via HTTP POST. Version 2.0-M5-2606 patches the issue.