CVE-2026-56138 is a path traversal vulnerability (CWE-22) in the ail-framework's /objects/item/diff endpoint. The endpoint accepts item identifiers via s1 and s2 query parameters and previously did not verify that these items existed as valid AIL objects before attempting to read and compare their contents. An authenticated user could exploit this flaw by crafting malicious item identifiers containing path traversal sequences, enabling the application to read gzip-compressed files accessible to the process, potentially disclosing local file contents. The vulnerability affects ail-framework versions before 6.8.0 and was remediated by adding validation to ensure both requested items exist prior to content access.

An authenticated user can cause the application to read arbitrary gzip-compressed files accessible to the AIL process by exploiting the path traversal vulnerability. This leads to unauthorized disclosure of local file contents, limited to files readable by the application and compatible with the expected gzip format. There is no indication of remote code execution or privilege escalation. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector with low complexity and no user interaction required.

A fix is available in ail-framework version 6.8.0 and later, which validates the existence of requested items before accessing their contents. Users should upgrade to version 6.8.0 or later to remediate this vulnerability. No additional mitigations are indicated by the vendor advisory.