CVE-2026-120324 Aklivity CVE debrief

Who should care

Defenders responsible for systems using Aklivity Zilla versions up to 1.3.4/2.4.7/2.5.0-rc2 should assess exposure and prioritize mitigation. This includes reviewing inventory, applying patches or upgrades, and monitoring for potential exploitation attempts.

Why it matters

CVE-2026-120324 is a medium-severity path traversal vulnerability in Aklivity Zilla's http-filesystem binding. Defenders should assess exposure, prioritize mitigation, and verify current versions to prevent potential unauthorized access or data exposure.

• Potential unauthorized access to sensitive files or data
• Possible data exposure or integrity issues
• Need for verification of current version and exposure
• Priority for upgrading or patching vulnerable systems

Technical summary

The vulnerability exists in the FileSystemServerFactory function of the http-filesystem binding in Aklivity Zilla. This function is affected by a path traversal issue, allowing remote attackers to manipulate file paths. The CVSS score for this vulnerability is 5.5 (Medium severity). Aklivity Zilla versions up to 1.3.4/2.4.7/2.5.0-rc2 are affected. The issue can be mitigated by upgrading to version 2.5.0-rc3 or applying the patch (46a8b15cbea157f7ae8b7cb865809a02fd6b1988). Defenders should assess exposure, prioritize mitigation, and verify current versions to prevent potential unauthorized access or data exposure.

Defensive priority

Medium priority for systems using Aklivity Zilla versions up to 1.3.4/2.4.7/2.5.0-rc2

Recommended defensive actions

• Upgrade Aklivity Zilla to version 2.5.0-rc3 or later
• Apply the patch (46a8b15cbea157f7ae8b7cb865809a02fd6b1988) to vulnerable versions
• Review and update inventory of systems using Aklivity Zilla versions up to 1.3.4/2.4.7/2.5.0-rc2
• Monitor for potential exploitation attempts
• Perform vulnerability scanning to identify exposed systems
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and potential mitigations. However, specific details about affected deployments, exploitation attempts, or business impacts are not provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.