What is CVE-2026-120324 in Aklivity Zilla?
A critical security flaw has been found in Rust zip library vulnerability style affecting data integrity, specifically designated as CVE-2026-120324 with a high CVSS score of 8.3. The vulnerability exists within the Path.resolve function of the FileSystemServerFactory file inside the http-filesystem Binding component.
This security issue stems from the improper handling and manipulation of the params argument. Attackers can leverage this weakness to execute path traversal attacks remotely without requiring prior authentication or user interaction.
Who is affected by this path traversal flaw?
This vulnerability impacts Aklivity Zilla versions up to 1.3.4, as well as versions up to 2.4.7 and 2.5.0-rc2. Systems utilizing the vulnerable http-filesystem Binding component are directly exposed to potential remote exploitation.
Public exploits for this security defect have already been made available, increasing the urgency for administrators to secure their environments against active scanning or targeted exploitation attempts.
How do I protect my system against this vulnerability?
Mitigating this vulnerability requires updating the affected software components immediately. Development teams have released an official fix via escalation of privileges vulnerability tracking measures or direct code repository updates.
Follow the steps below to properly secure your Aklivity Zilla deployment against potential file traversal exploitation.
- Verify your current Aklivity Zilla version to check if it falls under 1.3.4, 2.4.7, or 2.5.0-rc2.
- Upgrade the application framework to version 2.5.0-rc3 or higher.
- Alternatively, apply the official patch referenced as 46a8b15cbea157f7ae8b7cb865809a02fd6b1988 directly to your source tree.
- Restart your services and verify that the http-filesystem Binding component is running the updated binary.