{"id":"CVE-2026-120324","kind":"vulnerability","aliases":["CVE-2026-120324"],"related":[],"title":"Zilla: path traversal in HTTP filesystem binding exposes server files","description":"A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.5.0-rc3 is sufficient to fix this issue. Patch name: 46a8b15cbea157f7ae8b7cb865809a02fd6b1988. You should upgrade the affected component.","summary":"Aklivity Zilla's HTTP filesystem binding does not properly restrict the params argument in Path.resolve, so a remote request can use path traversal to reach files outside the intended directory. Public exploit code is reported to exist.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["http-filesystem","runtime","self-hosted","zilla"],"not_affected_if":["binding-not-enabled"],"how_to_check":"- Check the installed Zilla version and whether it is up to 1.3.4, 2.4.7, or 2.5.0-rc2.\n- Look for an http-filesystem binding in the Zilla configuration.","fix":"- Upgrade to `2.5.0-rc3` (patch `46a8b15cbea157f7ae8b7cb865809a02fd6b1988`).","status":"open","published_at":"2026-11-02T03:17:30+00:00","first_seen_at":"2026-11-02T03:31:23+00:00","triaged_at":"2026-11-02T03:31:50+00:00","updated_at":"2026-11-02T03:31:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-02T03:31:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade to `2.5.0-rc3` (patch `46a8b15cbea157f7ae8b7cb865809a02fd6b1988`).","reach":"internet","title":"Zilla: path traversal in HTTP filesystem binding exposes server files","impact":"high","summary":"Aklivity Zilla's HTTP filesystem binding does not properly restrict the params argument in Path.resolve, so a remote request can use path traversal to reach files outside the intended directory. Public exploit code is reported to exist.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["zilla","http-filesystem","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote attacker reads files outside the intended directory on the server.","analyst_note":"Confirm which versions and bindings are affected and whether the exploit is publicly documented at the NVD link.","how_to_check":"- Check the installed Zilla version and whether it is up to 1.3.4, 2.4.7, or 2.5.0-rc2.\n- Look for an http-filesystem binding in the Zilla configuration.","plain_action":"","needs_analyst":true,"not_affected_if":["binding-not-enabled"],"who_is_affected":"Teams running Aklivity Zilla with the http-filesystem binding exposed to remote requests are affected. Deployments without that binding enabled, or without remote access to it, are likely not exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000701,"input_tokens":4239,"output_tokens":554,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120324':13A,16A '-2026':12A,15A '/2.4.7/2.5.0-rc2':73C '1.3.4':72C '2.5.0':126C '46a8b15cbea157f7ae8b7cb865809a02fd6b1988':136C 'affect':75C,141C 'akliv':25B,68C 'argument':37B,96C 'attack':105C,122C 'avail':113C 'bind':7A,30B,91C 'caus':98C 'code':57B 'compon':87C,142C 'could':118C 'cve':11A,14A 'directori':54B 'element':76C 'exist':61B 'exploit':56B,102C,109C 'expos':8A 'file':10A,50B,83C 'filesystem':6A,19B,29B,90C 'filesystemserverfactori':84C 'fix':131C 'function':79C 'host':23B 'http':5A,18B,28B,89C 'http-filesystem':17B,88C 'identifi':66C 'intend':53B 'issu':133C 'made':112C 'manipul':93C 'name':135C 'outsid':51B 'param':36B,97C 'patch':134C 'path':2A,46B,99C 'path.resolve':39B,80C 'possibl':107C 'proper':33B 'public':55B,116C 'rc3':127C 'reach':49B 'remot':42B,101C 'report':59B 'request':43B 'restrict':34B 'runtim':20B 'self':22B 'self-host':21B 'server':9A 'suffici':129C 'travers':3A,47B,100C 'upgrad':123C,139C 'use':45B,120C 'version':125C 'weak':63C 'zilla':1A,24B,26B,69C","nicknames":[],"mitigations":[],"who_affected":"Teams running Aklivity Zilla with the http-filesystem binding exposed to remote requests are affected. Deployments without that binding enabled, or without remote access to it, are likely not exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","httpfilesystem","runtime","selfhosted","zilla"],"first_public_at":"2026-11-02T03:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120324","severity":null,"published_at":"2026-11-02T03:17:30+00:00","modified_at":"2026-11-02T03:17:30+00:00","first_seen_at":"2026-11-02T03:31:23+00:00","fetched_at":"2026-11-02T03:31:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}