High 8.3Published Nov 1, 2026

CVE-2026-120324Aklivity Zilla http-filesystem Binding FileSystemServerFactory Path.resolve path traversal

Updated under an hour ago (Nov 2, 2026, 1:40 AM ET)

Does this affect you?

It affects Aklivity Zilla. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stackFree account, 3 products Every CVE for Aklivity Zilla Exploited in the last 30 days

A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.5.0-rc3 is sufficient to fix this issue. Patch name: 46a8b15cbea157f7ae8b7cb865809a02fd6b1988. You should upgrade the affected component.

CVSS: 8.3 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C
Weakness (CWE): CWE-22
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Received
Record last updated: Nov 1, 2026
First seen by InfoSec Signals: Nov 1, 2026

Affected products

Affected products

Aklivity Zilla aklivity:zilla	1.3.0; 1.3.1; 1.3.2; 1.3.3; 1.3.4; 2.4.0; 2.4.1; 2.4.2; and 8 more ranges	CNA record

References

References

https://vuldb.com/vuln/429656	vdb-entry, technical-description
https://vuldb.com/vuln/429656/cti	signature, permissions-required
https://vuldb.com/cve/CVE-2026-120324	third-party-advisory
https://vuldb.com/submit/1015032	third-party-advisory
https://github.com/0xGenesi/CVE/blob/main/Zilla_Http_Filesystem_Binding_Path_Traversal.md	exploit
https://github.com/aklivity/zilla/pull/2623	issue-tracking, patch
https://github.com/aklivity/zilla/commit/46a8b15cbea157f7ae8b7cb865809a02fd6b1988	patch
https://github.com/aklivity/zilla/releases/tag/2.5.0-rc3	patch
https://github.com/aklivity/zilla/	product

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.