CVE-2026-35482

Name of the Vulnerable Software and Affected Versions alf.io versions prior to 2.0-M5-2606

Description A sandbox escape issue exists in the extension script engine of alf.io, an open source ticket reservation system. An authenticated administrator can execute arbitrary operating system commands on the server. The system uses a sandboxed Rhino environment to execute restricted JavaScript; however, the use of an unguarded injected Java object returnClass combined with an incomplete AST (Abstract Syntax Tree) blocklist allows the sandbox to be bypassed via Java reflection. This flaw can be triggered through the Extensions API.

Recommendations Update alf.io to version 2.0-M5-2606.