CVE-2026-59510 is a path traversal vulnerability (CWE-22) in the ail-project's ail-framework affecting versions up to 6.9.0. The vulnerability exists in the PDF.get_filepath() function, which constructs file paths by joining a configured PDF storage directory with a path derived from a PDF object identifier without verifying that the final resolved path remains within the intended directory. An authenticated attacker can exploit this by supplying crafted identifiers containing relative traversal sequences or absolute paths, causing the application to open files outside the PDF storage directory. This can result in unauthorized disclosure of files accessible to the AIL process, including sensitive local data such as application configuration and credentials. The vulnerability was addressed by applying os.path.realpath() to canonicalize the path and rejecting any paths that do not share the common directory with the configured PDF folder.

An authenticated attacker with the ability to invoke PDF object operations can exploit this vulnerability to read arbitrary files on the system that the AIL Framework process has access to, outside the intended PDF storage directory. This could lead to disclosure of sensitive information such as application configuration files, credentials, or other local data. There is no indication of remote code execution or privilege escalation. The CVSS 4.0 score is 7.1 (high severity), reflecting network attack vector, low attack complexity, and high impact on confidentiality.

No official patch or fix link is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed by canonicalizing file paths and rejecting those outside the configured PDF directory, so upgrading to a version including this fix is recommended once available. Until then, restrict access to authenticated users who can invoke PDF object operations and monitor for suspicious activity related to PDF object identifiers. Avoid exposing the vulnerable functionality to untrusted users.