Aklivity CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Aklivity CVE published 2026-11-02

CVE-2026-120324

A path traversal vulnerability exists in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2, specifically in the http-filesystem binding's FileSystemServerFactory function. This issue allows remote attackers to manipulate the 'params' argument, potentially leading to unauthorized access or data exposure. The vulnerability has been publicly disclosed and an exploit is available. Upgrading to version 2.5.0-rc3 or a [truncated]