---
id: "CVE-2026-120324"
kind: "vulnerability"
aliases: ["CVE-2026-120324"]
title: "Zilla: path traversal in HTTP filesystem binding exposes server files"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["http-filesystem", "runtime", "self-hosted", "zilla"]
not_affected_if: ["binding-not-enabled"]
published_at: "2026-11-02T03:17:30+00:00"
first_seen_at: "2026-11-02T03:31:23+00:00"
updated_at: "2026-11-02T03:31:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120324", "first_seen_at": "2026-11-02T03:31:23+00:00"}]
---

# Zilla: path traversal in HTTP filesystem binding exposes server files

Aklivity Zilla's HTTP filesystem binding does not properly restrict the params argument in Path.resolve, so a remote request can use path traversal to reach files outside the intended directory. Public exploit code is reported to exist.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Zilla version and whether it is up to 1.3.4, 2.4.7, or 2.5.0-rc2.
- Look for an http-filesystem binding in the Zilla configuration.

## Fix

- Upgrade to `2.5.0-rc3` (patch `46a8b15cbea157f7ae8b7cb865809a02fd6b1988`).

## Timeline

- 2026-11-02T03:31:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120324

## From the sources

A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.5.0-rc3 is sufficient to fix this issue. Patch name: 46a8b15cbea157f7ae8b7cb865809a02fd6b1988. You should upgrade the affected component.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_