CVE-2026-71445
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Reflected XSS vulnerability in AIL Framework at the /tag/add_tags endpoint. The error value is returned without proper encoding, allowing arbitrary HTML or JavaScript execution in the victim's browser.
Risk Assessment
An attacker could exploit this to perform actions in the context of an authenticated user's session, potentially leading to data theft or modification.
Recommendation
Update AIL Framework to the latest version and educate users about opening suspicious links.
Other vulnerabilities in AIL Framework
See all- CVE-2026-56138Medium
The AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. This allows an authenticated AIL user to craft malicious item identifiers that may lead to unauthorized disclosure of local files.
- CVE-2026-76164High
AIL Framework contains a server-side request forgery (SSRF) vulnerability in its crawler submission functionality. A low-privileged authenticated user can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can be instructed to make requests to internal addresses, including loopback, private networks, and cloud metadata services.
- CVE-2026-71446Medium
AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler without proper encoding. An attacker can inject malicious JavaScript into a stored URL, which executes in the analyst's browser when the screenshot icon is clicked.
- CVE-2026-59510High
AIL Framework has a path traversal vulnerability in its PDF object handling. The PDF.get_filepath() function constructs a file path by joining the configured PDF storage directory with a PDF object identifier without verifying the resolved path stays within the intended PDF_FOLDER directory. An authenticated attacker can use crafted identifiers with relative traversal sequences or absolute path components to open files outside the PDF directory, potentially disclosing sensitive data.
- CVE-2026-56448High
A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f. An authenticated AIL user can supply crafted object identifiers through the investigation workflow to access files outside the intended directories.
- CVE-2026-39416Medium
AIL framework is an open-source platform to collect, crawl, process and analyse unstructured data. Prior to version 6.8, a stored cross-site scripting (XSS) vulnerability was identified in the modal item preview functionality. When item content longer than 800 characters was processed, attacker-controlled content was returned without an explicit text/plain content type, allowing the browser to interpret the response as active HTML. This could result in execution of arbitrary JavaScript in the context of an authenticated user viewing a crafted item. This vulnerability is fixed in version 6.8.
Original NVD description (English source)
AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]). If attacker-controlled input was included in the generated error message, a crafted request could cause arbitrary HTML or JavaScript to be reflected in the response without appropriate output encoding. An attacker could exploit the vulnerability by convincing an authenticated AIL Framework user to open a specially crafted link. Successful exploitation could allow JavaScript to execute in the victim’s browser within the security context of the AIL Framework application. Depending on the victim’s privileges and the application’s protections, the attacker could perform actions using the victim’s session, access information available to the victim, or modify data through authenticated application requests. The vulnerability requires user interaction because the authenticated victim must follow or open the crafted request. The attacker does not necessarily require an AIL Framework account, provided that the crafted request can be delivered to an already authenticated user.