Zilla
Monthly
Path traversal in the Aklivity Zilla http-filesystem binding lets remote unauthenticated attackers who can reach the binding manipulate the params argument so that Path.resolve in FileSystemServerFactory escapes the intended filesystem root, exposing files the Zilla process can read. All releases up to and including 1.3.4, 2.4.7 and 2.5.0-rc2 are affected, but only deployments that actually configure and expose the http-filesystem binding are reachable; the assessed impact is confidentiality-only, bounded by the process's host read permissions. A public PoC reference exists (a write-up in a GitHub CVE repository); it is not verified as working exploit code, no CISA KEV listing confirms active exploitation, and vendor fixes are available in 2.5.0-rc3.
Path traversal in the Aklivity Zilla http-filesystem binding lets remote unauthenticated attackers who can reach the binding manipulate the params argument so that Path.resolve in FileSystemServerFactory escapes the intended filesystem root, exposing files the Zilla process can read. All releases up to and including 1.3.4, 2.4.7 and 2.5.0-rc2 are affected, but only deployments that actually configure and expose the http-filesystem binding are reachable; the assessed impact is confidentiality-only, bounded by the process's host read permissions. A public PoC reference exists (a write-up in a GitHub CVE repository); it is not verified as working exploit code, no CISA KEV listing confirms active exploitation, and vendor fixes are available in 2.5.0-rc3.