Read the docs
TI-2024-16855 Aliases CVE-2024-25627

Cross-Site Scripting (XSS) via File Upload in Alf.io

Priority MEDIUM 55CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Code execution, Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434 and CWE-79.

Summary

Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an XSS payload. This issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0043 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed alf.io (alfio-event): 2.0-M4-2304

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
alfio-eventalf.iobefore 2.0-M4-23042.0-M4-2304Patch availableCNA
  • alf.io Vendoralfio-event Affected before 2.0-M4-2304 Fixed in 2.0-M4-2304 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:alf:alf:*:*:*:*:*:*:*:*before 2.0-m4-2304Vulnerablealfio-event
  • cpe:2.3:a:alf:alf:*:*:*:*:*:*:*:* Versions before 2.0-m4-2304 Vulnerable ·alfio-event

Remediation

  • Fix · CNA alf.io (alfio-event) Fixed in 2.0-M4-2304

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25627

References

Exploit 1

  • TI-2026-27611 alf.io has an Authenticated RCE via Extension Script Sandbox Escape CVSS 3.1CRITICAL 9.1
  • TI-2024-16863 IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS CVSS 3.1HIGH 8.8
  • TI-2024-30371 Bypassing promo code limitations with race conditions CVSS 3.1HIGH 7.5
  • TI-2024-16862 IDOR make user can read e-mail log sent by other events CVSS 3.1HIGH 7.2
  • TI-2023-02118 Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io CVSS 3.1HIGH 7.2
  • TI-2024-30370 alf.io's preloaded data as json is not escaped correctly CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences