ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-41412

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups.

Published Jun 2, 2026 · catalog updated Jul 21, 2026 · alf.io is an open

Check if you run it

No confirmed exploitation is on record for CVE-2026-41412. EPSS is 0.47%. Act only if a listed version of alf.io is an open is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (alf.io is an open).
  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium4.9
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.47%
Remediation
Advisory link
Affected products
See sources for product scope

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, the alf.io extension sandbox injects a fully-functional HTTP client ( ) into every extension script's scope. The method accepts an arbitrary filesystem path as its parameter and reads the file contents using with no path validation, directory restriction, or allowlist. A malicious extension script can read any file accessible to the JVM process user and exfiltrate it to an attacker-controlled server via HTTP POST. Version 2.0-M5-2606 patches the issue.

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.

How to fix CVE-2026-41412

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-41412. EPSS is 0.47%. Act only if a listed version of alf.io is an open is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-22: Path Traversal; CWE-73. EPSS 0.47%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 2, 2026 · NIST NVD

    Detected

    alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, the alf.io extension sandbox injects a fully-functional HTTP client ( ) into every extension script's scope. The method accepts an arbitrary filesystem path as its parameter and reads the file contents using with no path validation, directory restriction, or allowl

  2. Jul 21, 2026 · NIST NVD

    Updated

    alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, the alf.io extension sandbox injects a fully-functional HTTP client ( ) into every extension script's scope. The method accepts an arbitrary filesystem path as its parameter and reads the file contents using with no path validation, directory restriction, or allowl

Sources

  • CVE.orgVulnerability recordCVE-2026-41412

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-41412

    30-day exploitation probability 0.5%

    first.org
  • NIST NVDVulnerability recordCVE-2026-41412

    alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, the alf.io extension sandbox injects a fully-functional HTTP client ( ) into every extension script's scope. The `postFileAndSav

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.