CVE-2026-41412

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-41412

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41412.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-41412

Aliases

GHSA-6m62-53cw-4373

Published

2026-06-02T22:51:36.358Z

Modified

2026-08-12T03:51:21.470906339Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

alf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension Script

Details

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, the alf.io extension sandbox injects a fully-functional HTTP client (simpleHttpClient) into every extension script's scope. The postFileAndSaveResponse() method accepts an arbitrary filesystem path as its file parameter and reads the file contents using new FileInputStream(file) with no path validation, directory restriction, or allowlist. A malicious extension script can read any file accessible to the JVM process user and exfiltrate it to an attacker-controlled server via HTTP POST. Version 2.0-M5-2606 patches the issue.

Database specific

{
    "cwe_ids": [
        "CWE-22",
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41412.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/alfio-event/alf.io

Affected ranges

Type

GIT

Repo

https://github.com/alfio-event/alf.io

Events

Introduced

Fixed

2b4759f9136cf5c6f5cb7784c30c9a09da217151

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0-M5-2606"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*

1.10

1.10-RC1

1.10-RC2

1.10.1

1.11

1.12

1.12-RC1

1.12-RC2

1.12-RC3

1.12-RC4

1.13

1.13-RC1

1.13-RC2

1.13-RC3

1.14

1.14-RC1

1.14-RC2

1.14.1

1.4

1.4-RC2

1.4.1

1.5

1.6

1.7

1.8

1.8-RC1

1.8-RC2

1.9

1.9.1

2.*

2.0-M0

2.0-M1

2.0-M1-1906

2.0-M1-1906.1

2.0-M2

2.0-M3

2.0-M4

2.0-M4-2204

2.0-M4-2301

2.0-M4-2304

2.0-M4.RC1

2.0-M4.RC2

2.0-M4.RC3

2.0-M4.RC4

2.0-M5

2.0-M5-2502

2.0-M5-2509

alfio-1.*

alfio-1.1

alfio-1.2

alfio-1.3

alfio-1.3-beta1

alfio-1.3.1

v1.*

v1.0-pre-rename

v1.0-pre-rename-v2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41412.json"