Live › vulnerability › CVE-2026-120324
Aklivity Zilla's HTTP filesystem binding does not properly restrict the params argument in Path.resolve, so a remote request can use path traversal to reach files outside the intended directory. Public exploit code is reported to exist.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 03:31 UTC. All times on this page are UTC.
Teams running Aklivity Zilla with the http-filesystem binding exposed to remote requests are affected. Deployments without that binding enabled, or without remote access to it, are likely not exposed; the sources do not say more.
No product ranges from the sources yet.
2.5.0-rc3 (patch 46a8b15cbea157f7ae8b7cb865809a02fd6b1988).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.5.0-rc3 is sufficient to fix this issue. Patch name: 46a8b15cbea157f7ae8b7cb865809a02fd6b1988. You should upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-120324")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.