EUVD-2026-41775
GHSA-jf65-fx73-9f2j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Authenticated PDF operation gives PR:L; vendor notes additional errors must be cleared first, so AC:H; arbitrary file read yields C:H with no integrity or availability impact.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
Lifecycle Timeline
1DescriptionCVE.org
AIL Framework contains a path traversal vulnerability in its PDF object handling. Prior to commit 14c618fce4d1df02358717c48ea903706abecdf2, the PDF.get_filepath() function constructed a file path by joining the configured PDF storage directory with a path derived from a PDF object identifier, without verifying that the resolved path remained within the intended PDF_FOLDER directory.
An authenticated attacker able to invoke PDF object operations with a crafted identifier could use relative traversal sequences or absolute path components to cause AIL Framework to open files located outside the PDF storage directory. This could allow disclosure of files readable by the AIL process, including application configuration, credentials, or other sensitive local data. This vulnerability is potential due to additional errors before being able to be executed.
The fix canonicalises the resulting path with os.path.realpath() and rejects paths whose common directory is outside the configured PDF directory.
AnalysisAI
Path traversal in AIL Framework's PDF object handling lets an authenticated user read files outside the intended PDF storage directory. The PDF.get_filepath() function joined the configured PDF_FOLDER with an attacker-influenced object identifier without validating the resolved location, so crafted relative traversal sequences or absolute path components could point AIL at arbitrary files readable by the service account, exposing configuration, credentials, or other local secrets. No public exploit identified at time of analysis, and the vendor notes exploitation is only potential because additional errors must be overcome before the traversal executes.
Technical ContextAI
AIL Framework (Analysis Information Leak framework) is an open-source, modular threat-intelligence platform maintained by CIRCL for analysing and detecting leaked or sensitive information in unstructured data feeds. The affected component is its PDF object handler, which persists and retrieves PDF artefacts under a configured PDF_FOLDER directory. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): PDF.get_filepath() built a filesystem path with a naive join of the storage root and a PDF object identifier, trusting that identifier as a safe relative component. Because Python's os.path.join discards the left operand when the right operand is absolute, and does not collapse '../' sequences, an identifier containing traversal or absolute-path elements escapes the intended directory. The fix canonicalises the path with os.path.realpath() and rejects any result whose common path with the configured PDF directory falls outside it.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - update AIL Framework to a build that includes commit 14c618fce4d1df02358717c48ea903706abecdf2, which adds os.path.realpath() canonicalisation and rejects paths whose common directory lies outside the configured PDF_FOLDER (patch: https://github.com/ail-project/ail-framework/commit/14c618fce4d1df02358717c48ea903706abecdf2.patch). If immediate patching is not possible, reduce exposure by restricting who holds authenticated AIL accounts and access to PDF object operations, since exploitation requires PR:L and trimming untrusted or shared accounts directly removes attack surface. Run the AIL process under a dedicated low-privilege service account whose filesystem read permissions are scoped as tightly as possible so a successful traversal reaches only non-sensitive files, and ensure application configuration and credential files are not readable by that user where feasible - note this hardens impact but does not close the flaw and may complicate legitimate file access. Avoid exposing the AIL web interface directly to untrusted networks; front it with network ACLs or a VPN to limit reachability given the network attack vector.
More in Ail Framework
View allStored cross-site scripting in AIL Framework <6.8 allows authenticated high-privilege attackers to inject malicious Java
Authenticated path traversal in AIL Framework (CIRCL's Analysis Information Leak threat-intel platform) lets a low-privi
Global.py in AIL framework 2.8 allows path traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
Non-blind SSRF in AIL Framework's crawler submission interface allows low-privileged authenticated users to pivot throug
Path traversal in AIL Framework's `/objects/item/diff` endpoint exposes gzip-compressed server-side files to authenticat
Unlimited OTP brute-force against AIL Framework's two-factor authentication endpoint allows an attacker who already poss
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today