CVE-2026-56138— Authenticated Path Traversal in AIL framework /objects/item/diff Allows Reading Gzip-Compressed Files

Authenticated Path Traversal in AIL framework /objects/item/diff Allows Reading Gzip-Compressed Files

AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item identifiers through the s1 and s2 query parameters and, prior to the fix, attempted to retrieve and compare item contents without first verifying that both referenced items existed as valid AIL objects. An authenticated AIL user could craft malicious item identifiers containing path traversal sequences to cause the application to read gzip-compressed files accessible to the AIL process. This could result in unauthorized disclosure of local file contents, limited to files readable by the application and compatible with the expected gzip-compressed item format. The issue was fixed by validating that both requested items exist before their contents are accessed.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

对路径名的限制不恰当(路径遍历)

ail-project ail-framework 路径遍历漏洞

ail-project ail-framework是ail-project组织的一个信息分析框架。 ail-project ail-framework 6.8.0之前版本存在路径遍历漏洞，该漏洞源于/objects/item/diff端点对项目标识符验证不足，可能导致经过身份验证的用户构造包含路径遍历序列的恶意标识符，从而读取AIL进程可访问的gzip压缩文件，造成本地文件内容泄露。

N/A

N/A