Path Traversal Vulnerability in AIL Framework by AIL Project

CVE-2026-56138

What is CVE-2026-56138?

The AIL Framework is susceptible to a path traversal vulnerability within its /objects/item/diff API endpoint. This flaw allows authenticated users to manipulate item identifiers via the s1 and s2 query parameters. Previously, the framework did not ensure that the referenced items were valid AIL objects before attempting to retrieve and compare their contents. Attackers could exploit this vulnerability by injecting malicious identifiers containing path traversal sequences, enabling them to access gzip-compressed files within the server's local file system. Although the vulnerability is now mitigated by validating item existence prior to content access, it serves as a reminder of the importance of stringent input validation to prevent unauthorized data exposure.

References