CVE-2026-35482
CRITICAL
CVSS 9.1
Java
Verified Advisory
Authenticated RCE via extension script sandbox escape in alf.io (CVE-2026-35482)
A sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system runs restricted JavaScript in a sandboxed Rhino environment, but an unguarded injected Java object (`returnClass`) enables full sandbox escape via Java reflection without triggering any validation errors. Exploitation occurs when a malicious extension script is saved and the chosen event fires.
Affected versions:
- ≤ 2.0-M5-2509-1
We recommend updating to: 2.0-M5-2606.
CVSS 9.1 · our assessment: act_now
Reference: https://github.com/alfio-event/alf.io/security/advisories/GHSA-3w8f-mcf6-cm7h
Details: https://vuln.today/cve/CVE-2026-35482
Verified by vuln.today against published advisories.
Affected versions
- – ≤ 2.0-M5-2509-1
Fixed in: 2.0-M5-2606
More advisories for Java
- CVE-2026-70440 – Multiple vulnerabilities in Jenkins and Jenkins plugins (CVE-2026-70440)
- CVE-2026-70427 – Arbitrary file write via symlink in tar extraction in Jenkins (CVE-2026-70427)
- CVE-2026-70432 – Cross-site request forgery in Jenkins Multijob Plugin (CVE-2026-70432)
- CVE-2026-70429 – Unicode username normalization bypass in Jenkins (CVE-2026-70429)
- CVE-2026-70431 – Groovy script sandbox escape in Jenkins Multijob Plugin (CVE-2026-70431)
- CVE-2026-70426 – Deserialization filter bypass in Jenkins Remoting library (CVE-2026-70426)
- CVE-2026-67553 – Denial of service via session flow control bypass in Apache Qpid Proton Dotnet (CVE-2026-67553)
- CVE-2026-67552 – Pre-authentication stack overflow in Apache Qpid Proton Dotnet (CVE-2026-67552)