alf.io vulnerabilities
3 known CVE vulnerabilities in alf.io, translated and rated.
- CVE-2026-50165High
In alf.io before version 2.0-M5-2605, an improper access control issue allows an organization owner to read system-level configuration secrets through organization/event scoped 'single configuration' endpoints, including the system API key.
- CVE-2026-41412Medium
Vulnerability in alf.io before version 2.0-M5-2606: the extension sandbox injects an HTTP client (`simpleHttpClient`) into scripts. The `postFileAndSaveResponse()` method accepts arbitrary file paths without validation, allowing malicious scripts to read and exfiltrate any file to an attacker-controlled server.
- CVE-2026-35482High
A sandbox escape vulnerability in alf.io, an open source ticket reservation system, allows an authenticated administrator to execute arbitrary OS commands on the server via the extension mechanism.