CVE-2026-56138 is a path traversal vulnerability (CWE-22) in the ail-framework's /objects/item/diff endpoint. The endpoint accepts item identifiers via s1 and s2 query parameters but previously failed to verify that these items existed as valid AIL objects before reading their contents. An authenticated user could exploit this flaw by crafting item identifiers containing path traversal sequences, enabling unauthorized reading of gzip-compressed files readable by the application. The vulnerability was addressed by implementing validation checks confirming the existence of both requested items prior to content access.

Exploitation allows an authenticated user to cause the application to read and disclose local gzip-compressed files accessible to the AIL process. This leads to unauthorized disclosure of local file contents limited to files readable by the application and compatible with the expected gzip format. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, and limited confidentiality impact.

A fix is available in ail-framework version 6.8.0 and later, which adds validation to ensure both requested items exist before their contents are accessed. Users should upgrade to version 6.8.0 or later to remediate this vulnerability. No vendor advisory or official patch link is provided, so verify with the vendor for the latest remediation guidance.