Stephen O

**Name of the Vulnerable Software and Affected Versions** AIL Framework versions prior to commit 0041456af25da0cdea1c1c4624e46baff2731d8f **Description** A path traversal issue allows an authenticated user to supply crafted object identifiers through the investigation workflow, causing file paths to resolve outside the intended image, favicon, or screenshot storage directories. This occurs because user-controlled path components are joined with application storage paths without verifying that the resolved path remains within the expected directory. Consequently, an attacker can download and read arbitrary files accessible to the AIL process via the affected download functionality, which may include these files in a generated archive. **Recommendations** Update to the release containing commit 0041456af25da0cdea1c1c4624e46baff2731d8f.

**Name of the Vulnerable Software and Affected Versions** AIL (affected versions not specified) **Description** AIL failed to restrict repeated unsuccessful attempts to verify a two-factor authentication (OTP) code. An attacker who successfully completed the password authentication stage could submit an unlimited number of OTP guesses. This allows for brute-force guessing of a valid code to bypass the second authentication factor and gain unauthorized account access. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.