CVE-2026-120324— Aklivity Zilla http-filesystem Binding FileSystemServerFactory Path.resolve path traversal

Quick assessment

Affected

Aklivity Zilla

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Aklivity Zilla 1.3.4、2.4.7 及 2.5.0-rc2 及更早版本中发现了一个安全漏洞。受影响的是绑定组件中文件内的函数。由于对参数的处理不当，导致路径遍历（Path Traversal）漏洞。该漏洞可被远程利用，且利用代码已公开，可能被用于发起攻击。升级至版本 2.5.0-rc3 即可修复此问题。相关补丁提交哈希为：46a8b15cbea157f7ae8b7cb865809a02fd6b1988。建议立即升级受影响的组件。

CVSS 8.3 · High Updated Nov 02, 2026

Possible ATT&CK Techniques 2 AI

T1059.007 · JavaScript T1565.002 · Transmitted Data Manipulation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Aklivity Zilla http-filesystem Binding FileSystemServerFactory Path.resolve path traversal

Source: CVE Program / CVE List V5

Vulnerability Description

A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.5.0-rc3 is sufficient to fix this issue. Patch name: 46a8b15cbea157f7ae8b7cb865809a02fd6b1988. You should upgrade the affected component.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Aklivity	Zilla	1.3.0	`cpe:2.3:a:aklivity:zilla::::::::`

II. Public POCs for CVE-2026-120324

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-120324

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-120324 (1)

CVE-2026-120324 | Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2 http-filesystem Binding FileSystemServerFactory Path.resolve params path traversal vdb-entry technical-description

Other References for CVE-2026-120324 (8)

https://github.com/aklivity/zilla/pull/2623 issue-tracking patch
https://github.com/aklivity/zilla/releases/tag/2.5.0-rc3 patch
https://github.com/0xGenesi/CVE/blob/main/Zilla_Http_Filesystem_Binding_Path_Traversal.md exploit
https://github.com/aklivity/zilla/commit/46a8b15cbea157f7ae8b7cb865809a02fd6b1988 patch
https://github.com/aklivity/zilla/ product
https://vuldb.com/cve/CVE-2026-120324 third-party-advisory
https://vuldb.com/vuln/429656/cti signature permissions-required
https://vuldb.com/submit/1015032 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-120324

IV. Related Vulnerabilities

Same weakness: CWE-22