Read the docs
TI-2026-42473 Aliases CVE-2026-59510GHSA-jf65-fx73-9f2j

Authenticated Path Traversal in AIL Framework PDF Object Handling Enables Potential Arbitrary File Read

Priority LOW 32CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

AIL Framework contains a path traversal vulnerability in its PDF object handling. Prior to commit 14c618fce4d1df02358717c48ea903706abecdf2, the PDF.get_filepath() function constructed a file path by joining the configured PDF storage directory with a path derived from a PDF object identifier, without verifying that the resolved path remained within the intended PDF_FOLDER directory. An authenticated attacker able to invoke PDF object operations with a crafted identifier could use relative traversal sequences or absolute path components to cause AIL Framework to open files located outside the PDF storage directory. This could allow disclosure of files readable by the AIL process, including application configuration, credentials, or other sensitive local data. This vulnerability is potential due to additional errors before being able to be executed. The fix canonicalises the resulting path with os.path.realpath() and rejects paths whose common directory is outside the configured PDF directory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0051 43rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ail projectail-frameworkup to v6.9.0—No fix listedCNA
  • ail-framework Vendorail project Affected up to v6.9.0 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59510
  2. 2026-10-03 Alias added: GHSA-jf65-fx73-9f2j

References

Patch 1

  • TI-2026-64575 Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip CVSS 4.0HIGH 8.5
  • TI-2026-64573 Cross-site scripting in ail framework CVSS 4.0HIGH 8.5
  • TI-2026-64579 AIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation CVSS 4.0MEDIUM 6.9
  • TI-2026-53282 Authenticated Server-Side Request Forgery in AIL Framework Crawler Allows Access to Internal Network Resources CVSS 4.0HIGH 7.1
  • TI-2026-50065 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework CVSS 4.0HIGH 8.2
  • TI-2026-40787 Authenticated Path Traversal in AIL Framework Investigation Downloads Allows Arbitrary File Read CVSS 4.0HIGH 8.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences