CVE-2026-59510 Authenticated Path Traversal in AIL Framework PDF Object Handling Enables Potential Arbitrary File Read
Authenticated attackers can exploit path traversal in PDF handling to read sensitive files outside the storage directory, requiring a patch to canonicalize paths.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-59510?
CVE-2026-59510 is a high-severity path traversal vulnerability in ail-project ail-framework, published on 5 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
AIL Framework contains a path traversal vulnerability in its PDF object handling. Prior to commit 14c618fce4d1df02358717c48ea903706abecdf2, the PDF.get_filepath() function constructed a file path by joining the configured PDF storage directory with a path derived from a PDF object identifier, without verifying that the resolved path remained within the intended PDF_FOLDER directory.
An authenticated attacker able to invoke PDF object operations with a crafted identifier could use relative traversal sequences or absolute path components to cause AIL Framework to open files located outside the PDF storage directory. This could allow disclosure of files readable by the AIL process, including application configuration, credentials, or other sensitive local data. This vulnerability is potential due to additional errors before being able to be executed.
The fix canonicalises the resulting path with os.path.realpath() and rejects paths whose common directory is outside the configured PDF directory.
Weakness: CWE-22
Which versions are affected by CVE-2026-59510?
How do I fix CVE-2026-59510?
No fix has been published for CVE-2026-59510 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-59510 being exploited?
There is no known exploitation of CVE-2026-59510 in the wild and no public exploit code.
Sources
Also known as GHSA-jf65-fx73-9f2j.