CVE-2026-35482: alf.io has an Authenticated RCE via Extension Script Sandbox Escape

Synopsis

This is an authenticated remote code execution (RCE) vulnerability in alf.io, an open-source ticket reservation system. An attacker with administrator-level access can craft a malicious extension script that escapes the JavaScript sandbox using Java reflection, bypassing the intended restrictions of the Rhino scripting engine, and execute arbitrary operating system commands on the host server. Successful exploitation gives full command execution on the server. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the alf.io service over the network; the service must be accessible from the attacker's position on the internet or internal network.

• AuthenticationRequired

  A valid administrator account is required; any lower-privilege account is not sufficient to access the extension script engine.

• Victim interactionNot required

  No user interaction is needed; the attacker triggers the sandbox escape entirely through their own requests.

• Attack complexityDetail

  Exploitation involves constructing a specific Java reflection chain through the unguarded injected object, meaning some knowledge of the sandbox internals is required, though no race conditions or environment-specific memory layout factors apply.

Blast Radius

• Executes arbitrary operating system commands on the host server, giving the attacker the same privileges as the alf.io process.
• Reads any file accessible to that process, including database credentials, private keys, and event attendee records stored on disk or reachable via the local network.
• Modifies or deletes server files, database contents, and configuration, including attendee registration data and payment-related records.
• Crashes or disrupts the alf.io service and any co-located services reachable from the compromised process.