Skip to content
Heist/ feed
Back to feed
Medium

Authenticated Path Traversal in AIL framework /objects/item/diff Allows Reading Gzip-Compressed Files

Type: advisorySources: OSV

AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item identifiers through the s1 and s2 query parameters and, prior to the fix, attempted to retrieve and compare item contents without first verifying that both referenced items existed as valid AIL objects. An authenticated AIL user could craft malicious item identifiers containing path traversal sequences to cause the application to read gzip-compressed files accessible to the AIL process. This could result in unauthorized disclosure of local file contents, limited to files readable by the application and compatible with the expected gzip-compressed item format. The issue was fixed by validating that both requested items exist before their contents are accessed.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-56138
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 08:35 UTC · Revision 1

Source evidence

Authenticated Path Traversal in AIL framework /objects/item/diff Allows Reading Gzip-Compressed Files

core-osv · Original source

Published 19 Jun 2026, 08:03 UTC

AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item identifiers through the s1 and s2 query parameters and, prior to the fix, attempted to retrieve and compare item contents without first verifying that both referenced items existed as valid AIL objects. An authenticated AIL user could craft malicious item identifiers containing path traversal sequences to cause the application to read gzip-compressed files accessible to the AIL process. This could result in unauthorized disclosure of local file contents, limited to files readable by the application and compatible with the expected gzip-compressed item format. The issue was fixed by validating that both requested items exist before their contents are accessed.

osv:CVE-2026-56138
Complete source record
{
  "id": "ec2176a47019ff92241fe69d23d2618b1b38ab4a503b659bf342959f80f944e8",
  "url": "https://osv.dev/vulnerability/CVE-2026-56138",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Authenticated Path Traversal in AIL framework /objects/item/diff Allows Reading Gzip-Compressed Files",
    "summary": "AIL framework contains a path traversal vulnerability in the /objects/item/diff endpoint. The endpoint accepts item identifiers through the s1 and s2 query parameters and, prior to the fix, attempted to retrieve and compare item contents without first verifying that both referenced items existed as valid AIL objects. An authenticated AIL user could craft malicious item identifiers containing path traversal sequences to cause the application to read gzip-compressed files accessible to the AIL process. This could result in unauthorized disclosure of local file contents, limited to files readable by the application and compatible with the expected gzip-compressed item format. The issue was fixed by validating that both requested items exist before their contents are accessed.",
    "evidence": "osv:CVE-2026-56138",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-56138",
      "aliases": [
        "CVE-2026-56138"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/ail-project/ail-framework",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "074f9a432702d39d7f8db07ece3a11502cf36d73"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "fixed": "074f9a432702d39d7f8db07ece3a11502cf36d73"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v6.8",
            "v6.7",
            "v6.6",
            "v6.1",
            "v6.0.1",
            "v6.0",
            "v5.9",
            "v5.8",
            "v5.7",
            "v5.5",
            "v5.4",
            "v5.3",
            "v5.0",
            "v4.1",
            "v4.0",
            "v3.7",
            "v3.6",
            "v3.5",
            "v3.1",
            "v3.0",
            "v2.8",
            "v2.7",
            "v2.6",
            "v2.5",
            "v2.4",
            "v2.3",
            "v2.2",
            "v2.1",
            "v2.0",
            "v1.8",
            "v1.7",
            "v1.6",
            "v1.5",
            "v1.3",
            "v1.2",
            "v1.1",
            "v1.0",
            "v0.90"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56138.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:27.274873745Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56138.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-56138",
        "https://github.com/ail-project/ail-framework/commit/074f9a432702d39d7f8db07ece3a11502cf36d73",
        "https://github.com/ail-project/ail-framework"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "cna_assigner": "CIRCL",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "fixed": "6.8.0"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56138.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-56138",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 493869,
  "published_at": "2026-06-19T08:03:58.954+00:00"
}