CVE-2026-59510 is a path traversal vulnerability (CWE-22) in ail-project's ail-framework affecting versions up to 6.9.0. The issue exists in the PDF.get_filepath() function, which joins a configured PDF storage directory with a path derived from a PDF object identifier without ensuring the final resolved path is confined within the intended directory. This allows an authenticated attacker to craft identifiers containing relative traversal sequences or absolute paths to access files outside the PDF storage directory. The vulnerability could disclose sensitive local files accessible to the AIL process. The fix involves using os.path.realpath() to canonicalize the path and rejecting any paths that do not share the common directory with the configured PDF folder.

An authenticated attacker can exploit this vulnerability to read arbitrary files on the system that are accessible by the AIL Framework process, potentially exposing sensitive information such as application configuration files, credentials, or other local data. There is no indication of remote code execution or privilege escalation. The CVSS 4.0 score is 7.1 (high severity) reflecting network attack vector, low attack complexity, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability was fixed by canonicalizing file paths and rejecting those outside the intended directory, but no official patch or fix link is provided in the available data. Until an official fix is applied, restrict authenticated user access to PDF object operations and monitor for suspicious activity involving crafted PDF identifiers.