Read the docs
TI-2026-40514 Aliases CVE-2026-56138GHSA-jmhf-2rhf-v8gj

Authenticated Path Traversal in AIL framework /objects/item/diff Allows Reading Gzip-Compressed Files

Priority LOW 25CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item identifiers through the s1 and s2 query parameters and, prior to the fix, attempted to retrieve and compare item contents without first verifying that both referenced items existed as valid AIL objects. An authenticated AIL user could craft malicious item identifiers containing path traversal sequences to cause the application to read gzip-compressed files accessible to the AIL process. This could result in unauthorized disclosure of local file contents, limited to files readable by the application and compatible with the expected gzip-compressed item format. The issue was fixed by validating that both requested items exist before their contents are accessed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0051 43rd percentileScored 2026-11-07
Fix Fixed ail-framework (ail-project): 6.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ail projectail-frameworkbefore 6.8.06.8.0Patch availableCNA
  • ail-framework Vendorail project Affected before 6.8.0 Fixed in 6.8.0 Patch available CNA

Remediation

  • Fix · CNA ail-framework (ail-project) Fixed in 6.8.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-56138
  2. 2026-10-03 Alias added: GHSA-jmhf-2rhf-v8gj

References

Patch 1

  • TI-2026-64575 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip CVSS 4.0HIGH 8.5
  • TI-2026-64573 Cross-site scripting in ail framework CVSS 4.0HIGH 8.5
  • TI-2026-64579 AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation CVSS 4.0MEDIUM 6.9
  • TI-2026-53282 Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources CVSS 4.0HIGH 7.1
  • TI-2026-50065 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework CVSS 4.0HIGH 8.2
  • TI-2026-40787 Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read CVSS 4.0HIGH 8.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences