The vulnerability is a sandbox escape in the extension script engine of alf.io, a CWE-863 flaw, allowing an authenticated administrator to execute arbitrary operating system commands on the host. By injecting an unguarded Java object and leveraging Java reflection, the Rhino sandbox can be bypassed, enabling full control over the server. This flaw provides an attacker—who already has administrator credentials—to compromise confidentiality, integrity, and availability of the system.

All installations of alf.io running any version older than 2.0‑M5‑2606 are affected. The application is distributed by the vendor alfio‑event as the product alf.io, used as an open‑source ticket reservation platform for conferences and related events.

The CVSS score of 8 signals a high‑severity vulnerability; while EPSS data is not available, the lack of being listed in CISA's KEV catalog does not mean it is unlikely to be exploited. The flaw requires authenticated access at the administrator level, so the attack vector is internal privileged use, but once the administrator credential is compromised, an attacker can exceed the intended sandbox boundaries. Due to the potential for arbitrary command execution, the risk to the affected environment is high, and mitigation should be prioritized.