CVE-2026-35482 is a sandbox escape in the alf.io extension script engine, scored 8.0 (High) in the CVE record. An authenticated administrator can break out of the sandbox and run operating system commands on the server. The fixed version is 2.0-M5-2606, so upgrade to it.
What's affected
- Product: alf.io, the open source ticket reservation system
- Affected versions: before 2.0-M5-2606. The GitHub advisory lists up to 2.0-M5-2509-1
- Fixed version: 2.0-M5-2606
- Condition: an authenticated administrator
The advisory says the extension system is meant to run restricted JavaScript in a sandboxed Rhino environment. It names an unguarded Java object that the engine injected into every script as the opening, and notes that the incomplete static check did not catch it. The script runs the next time its chosen event fires, with no other action needed. The CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Check the version of your alf.io deployment, either from the container image tag or the application jar name.
docker image ls | grep -i alfio
If your version is older than 2.0-M5-2606, you are in scope. Then list the administrator accounts, and look at the extensions saved in the admin area. Any extension you did not write or approve deserves a close look.
What to do now
- Upgrade alf.io to 2.0-M5-2606 or later.
- Review the list of administrator accounts and remove any that are not needed.
- Review all saved extension scripts and delete those you do not recognise.
- Run alf.io under a service account with limited rights and no access to other systems.
- Check server logs for extension saves and for unexpected processes started by the service.
Why it matters
The record files this under CWE-863, incorrect authorization. The sandbox was the access boundary. It combined a static check of the script text with a reduced set of Rhino globals and a whitelist for Java types. The advisory says an object handed to the script gave it a way back to the full Java reflection API, and the text checks did not notice.
This is the usual weakness of denylist style sandboxes. They list bad patterns, and any path the list misses is a hole. Where scripts must run, give them a narrow, explicit API and run the whole service with few rights, so a failure costs little.
Quick check
Do I need to be an administrator to use this?
Yes. The advisory describes an authenticated administrator, and the CVSS vector requires high privileges.
Which version fixes it?
2.0-M5-2606.
Sources
Last reviewed: 19 October 2026.
