CVE Explorer

CVE-2026-41412

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, the alf.io extension sandbox injects a fully-functional HTTP client (`simpleHttpClient`) into every extension script's scope. The `postFileAndSaveResponse()` method accepts an arbitrary filesystem path as its `file` parameter and reads the file contents using `new FileInputStream(file)` with no path validation, directory restriction, or allowlist. A malicious ext

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:8baf7f7bd0dc6925a90abb668379ce85a2ed6aed9654c829e488175313517b4d

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-73","description":"CWE-73: External Control of File Name or Path","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:91b6fa97b655daed8bfd38bd9c97f53c290e52358684be75783b761c5d9484d1 · sha256:5b4f5986f6ebd01b… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-22","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:91b6fa97b655daed8bfd38bd9c97f53c290e52358684be75783b761c5d9484d1 · sha256:5b4f5986f6ebd01b… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion

{"product":"alf.io","vendor":"alfio-event","versions":[{"status":"affected","version":"< 2.0-M5-2606"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:91b6fa97b655daed8bfd38bd9c97f53c290e52358684be75783b761c5d9484d1 · sha256:5b4f5986f6ebd01b… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:91b6fa97b655daed8bfd38bd9c97f53c290e52358684be75783b761c5d9484d1 · sha256:5b4f5986f6ebd01b… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions

{"cweId":"CWE-73","description":"CWE-73: External Control of File Name or Path","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:91b6fa97b655daed8bfd38bd9c97f53c290e52358684be75783b761c5d9484d1 · sha256:5b4f5986f6ebd01b… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-22","description":"CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:91b6fa97b655daed8bfd38bd9c97f53c290e52358684be75783b761c5d9484d1 · sha256:5b4f5986f6ebd01b… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"tags":["exploit"],"url":"https://github.com/alfio-event/alf.io/security/advisories/GHSA-6m62-53cw-4373"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:91b6fa97b655daed8bfd38bd9c97f53c290e52358684be75783b761c5d9484d1 · sha256:5b4f5986f6ebd01b… · /containers/adp/0/references/0

{"name":"https://github.com/alfio-event/alf.io/security/advisories/GHSA-6m62-53cw-4373","tags":["x_refsource_CONFIRM"],"url":"https://github.com/alfio-event/alf.io/security/advisories/GHSA-6m62-53cw-4373"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:91b6fa97b655daed8bfd38bd9c97f53c290e52358684be75783b761c5d9484d1 · sha256:5b4f5986f6ebd01b… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer