CVE-2026-56138 Details
Description
AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item identifiers through the s1 and s2 query parameters and, prior to the fix, attempted to retrieve and compare item contents without first verifying that both referenced items existed as valid AIL objects. An authenticated AIL user could craft malicious item identifiers containing path traversal sequences to cause the application to read gzip-compressed files accessible to the AIL process. This could result in unauthorized disclosure of local file contents, limited to files readable by the application and compatible with the expected gzip-compressed item format. The issue was fixed by validating that both requested items exist before their contents are accessed.
A path traversal vulnerability has been identified in the AIL framework within the '/objects/item/diff' endpoint. This vulnerability allows authenticated AIL users to craft malicious item identifiers that include path traversal sequences. The endpoint, which compares item contents based on identifiers provided through the 's1' and 's2' query parameters, failed to verify the validity of these identifiers before accessing the item contents. As a result, the application could be manipulated to read gzip-compressed files accessible to the AIL process. This exploitation could lead to unauthorized disclosure of local file contents, limited to files readable by the application and compatible with the expected gzip-compressed item format.
The vulnerability has been addressed by implementing a validation step to ensure that both requested items exist before their contents are accessed. Users should update to the latest version of the AIL framework where this fix has been applied.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 19, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ail-project/ail-framework/commit/074f9a432702d39d7f8db07ece3a11502cf36d73 | CIRCL | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CIRCL |
Affected Products
| Product | Versions |
|---|---|
| AIL framework | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 19, 2026 | New CVE Received | CIRCL |