CVE-2026-35482: alf.io has an Authenticated RCE via Extension Script Sandbox Escape
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environment; however, a combination of an unguarded injected Java object (returnClass) and an incomplete AST blocklist allows the sandbox to be fully escaped using Java reflection without triggering any validation errors. Version 2.0-M5-2606 patches the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alf.io extension script engine (alf.io extension script sandbox)to a version that resolves this vulnerability.Fixed in 2.0-M5-2606
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35482?
The severity of CVE-2026-35482 is rated as high, with a score of 8.
How do I fix CVE-2026-35482?
To fix CVE-2026-35482, upgrade to alf.io version 2.0-M5-2606 or later.
What type of vulnerability is CVE-2026-35482?
CVE-2026-35482 is an authenticated remote code execution vulnerability due to a sandbox escape in the alf.io extension script engine.
Who is affected by CVE-2026-35482?
Authenticated administrators using alf.io versions prior to 2.0-M5-2606 are affected by CVE-2026-35482.
What are the potential impacts of CVE-2026-35482?
The impact of CVE-2026-35482 includes the potential for an authenticated user to execute arbitrary operating system commands on the server.