ail-project ail-framework up to 6.7.x Endpoint /objects/item/diff path traversal

Summaryinfo

A vulnerability, which was classified as critical, was found in ail-project ail-framework up to 6.7.x. The impacted element is an unknown function of the file /objects/item/diff of the component Endpoint. Executing a manipulation can lead to path traversal. This vulnerability is handled as CVE-2026-56138. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in ail-project ail-framework up to 6.7.x. It has been declared as critical. This vulnerability affects some unknown functionality of the file /objects/item/diff of the component Endpoint. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality. CVE summarizes:

AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item identifiers through the s1 and s2 query parameters and, prior to the fix, attempted to retrieve and compare item contents without first verifying that both referenced items existed as valid AIL objects. An authenticated AIL user could craft malicious item identifiers containing path traversal sequences to cause the application to read gzip-compressed files accessible to the AIL process. This could result in unauthorized disclosure of local file contents, limited to files readable by the application and compatible with the expected gzip-compressed item format. The issue was fixed by validating that both requested items exist before their contents are accessed.

The weakness was released by Stephen O @SakusenSec as 074f9a432702d39d7f8db07ece3a11502cf36d73. The advisory is available at github.com. This vulnerability was named CVE-2026-56138 since 06/19/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

Upgrading to version 6.8.0 eliminates this vulnerability. Applying the patch 074f9a432702d39d7f8db07ece3a11502cf36d73 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-37998). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Project Management Software

Vendor

• ail-project

Name

• ail-framework

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7

License

• open-source

Website

• Product: https://github.com/ail-project/ail-framework/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion