CVE-2026-35482 Details
Description
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environment; however, a combination of an unguarded injected Java object (`returnClass`) and an incomplete AST blocklist allows the sandbox to be fully escaped using Java reflection without triggering any validation errors. Version 2.0-M5-2606 patches the issue.
A sandbox escape vulnerability has been identified in alf.io, an open-source ticket reservation system, prior to version 2.0-M5-2606. This vulnerability allows authenticated administrators to execute arbitrary operating system commands on the server. The issue arises in the extension script engine, which is designed to run restricted JavaScript in a sandboxed Rhino environment. However, an unguarded injected Java object, 'returnClass', combined with an incomplete Abstract Syntax Tree (AST) blocklist, enables a full escape from the sandbox using Java reflection, bypassing validation errors. The vulnerability is triggered when an extension script is saved, with the malicious code executing during the next relevant event, such as 'INVOICE_GENERATION' on the first ticket purchase with invoicing enabled.
Users are advised to update to alf.io version 2.0-M5-2606 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/alfio-event/alf.io/security/advisories/GHSA-3w8f-mcf6-cm7h | CISA-ADP | ExploitVendor Advisory |
| https://github.com/alfio-event/alf.io/security/advisories/GHSA-3w8f-mcf6-cm7h | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| alf alf | < 2.0-M5-2606 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | New CVE Received | [email protected] |