CVE-2026-35482 Overview
CVE-2026-35482 is a sandbox escape vulnerability in alf.io, an open source ticket reservation system for conferences, trade shows, workshops, and meetups. The flaw resides in the extension script engine, which executes restricted JavaScript inside a sandboxed Rhino environment. An authenticated administrator can escape the sandbox and execute arbitrary operating system commands on the server. The issue is tracked under [CWE-863] Incorrect Authorization. Versions prior to 2.0-M5-2606 are affected. Version 2.0-M5-2606 patches the vulnerability.
Critical Impact
Authenticated administrators can break out of the Rhino JavaScript sandbox and run arbitrary OS commands on the alf.io server, leading to full host compromise.
Affected Products
- alf.io ticket reservation platform versions prior to 2.0-M5-2606
- Deployments exposing the extension script engine to administrator users
- Self-hosted alf.io instances running the Rhino-based extension runtime
Discovery Timeline
- 2026-06-02 - CVE-2026-35482 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-35482
Vulnerability Analysis
The alf.io extension system allows administrators to register JavaScript snippets that run inside a Mozilla Rhino sandbox. The sandbox is designed to restrict access to dangerous Java classes and reflection APIs. The implementation enforces these restrictions through two mechanisms: an Abstract Syntax Tree (AST) blocklist that rejects forbidden identifiers, and a curated set of host objects exposed to the script context. Both mechanisms fail in this case. The AST blocklist is incomplete, and an injected Java object named returnClass is left unguarded inside the script scope. Together these gaps let an attacker reach java.lang.Class and the broader reflection API from inside the sandbox.
Root Cause
The root cause is an authorization and isolation failure in the extension runtime ([CWE-863]). The returnClass host object exposes a reachable java.lang.Class reference that is never validated against the blocklist. The AST scanner fails to recognize all property-access patterns that yield reflective access. Attackers chain these to obtain a ClassLoader, load java.lang.Runtime, and invoke exec without ever tripping a validation error.
Attack Vector
Exploitation requires an authenticated account with administrator privileges that can save or update an extension script. The attacker submits a crafted JavaScript extension that walks reflective methods on the returnClass object to resolve Runtime.getRuntime() and execute arbitrary commands. Because the script runs server-side under the alf.io process identity, command execution inherits the privileges of that service account. The attack is delivered over the network through the standard alf.io administration interface. Refer to the GitHub Security Advisory GHSA-3w8f-mcf6-cm7h for the full technical write-up.
Detection Methods for CVE-2026-35482
Indicators of Compromise
- Newly created or modified alf.io extension scripts containing references to returnClass, getClass, forName, Runtime, or ProcessBuilder.
- Child processes such as sh, bash, cmd.exe, powershell.exe, or curl spawned by the Java process hosting alf.io.
- Outbound network connections initiated by the alf.io JVM to unexpected destinations shortly after extension changes.
- Administrator audit log entries showing extension create or update actions followed by unusual server activity.
Detection Strategies
- Inspect the alf.io extension table and version history for scripts containing reflection identifiers or string concatenation that hides Java class names.
- Correlate extension modification events with process creation telemetry from the host running alf.io.
- Alert on the alf.io JVM spawning shell interpreters or command-line utilities, which is not expected during normal operation.
- Review administrator authentication logs for unusual login times, source IPs, or failed multi-factor authentication preceding extension changes.
Monitoring Recommendations
- Forward alf.io application logs and JVM process telemetry to a centralized logging pipeline for correlation.
- Baseline normal child-process behavior of the alf.io service and alert on deviations.
- Track administrative role assignments and review them on a recurring schedule to limit the attack surface.
- Monitor outbound egress from the alf.io host and restrict it through network policy where feasible.
How to Mitigate CVE-2026-35482
Immediate Actions Required
- Upgrade alf.io to version 2.0-M5-2606 or later, which removes the unguarded returnClass injection and tightens the AST blocklist.
- Audit all existing extension scripts for reflection patterns and remove any unauthorized entries before upgrading.
- Rotate administrator credentials and API tokens that may have been exposed on a vulnerable instance.
- Review server logs and process history for signs of prior exploitation on hosts running affected versions.
Patch Information
The maintainers released version 2.0-M5-2606 to address CVE-2026-35482. The fix removes the unguarded returnClass Java object from the script scope and extends the AST blocklist to cover reflection access patterns. See the alf.io GitHub Security Advisory GHSA-3w8f-mcf6-cm7h for upgrade instructions and patch details.
Workarounds
- Restrict administrator role membership to a minimal set of trusted operators until the patched version is deployed.
- Disable the extension feature in environments that do not require custom scripts.
- Enforce multi-factor authentication for all administrator accounts to reduce the risk of credential abuse.
- Place the alf.io host behind network egress controls so that command execution attempts cannot reach external infrastructure.
# Configuration example: upgrade alf.io to the patched release
git fetch --tags
git checkout 2.0-M5-2606
./mvnw clean package -Pprod
systemctl restart alfio
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
