{"id":"CVE-2026-124329","kind":"vulnerability","aliases":["CVE-2026-124329"],"related":[],"title":"FlowCI flow-core-x: zip extraction path traversal writes files outside target","description":"A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the function FileHelper.unzip of the file common/src/main/java/com/flowci/common/helper/FileHelper.java. The manipulation results in path traversal. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"FlowCI flow-core-x up to 1.23.49 has a path traversal flaw in FileHelper.unzip, which extracts zip archives. A remote attacker who supplies a crafted archive can make files land outside the intended directory.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","flow-core-x","flowci","java","package"],"not_affected_if":["no-untrusted-zip-input"],"how_to_check":"- Check the installed flow-core-x version against `1.23.49`\n- Look for FileHelper.unzip in common/src/main/java/com/flowci/common/helper/FileHelper.java and confirm whether it is reached with untrusted archives","fix":null,"status":"open","published_at":"2026-11-08T12:17:48+00:00","first_seen_at":"2026-11-08T12:47:40+00:00","triaged_at":"2026-11-08T12:49:33+00:00","updated_at":"2026-11-08T12:49:33+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T12:49:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FlowCI flow-core-x: zip extraction path traversal writes files outside target","impact":"medium","summary":"FlowCI flow-core-x up to 1.23.49 has a path traversal flaw in FileHelper.unzip, which extracts zip archives. A remote attacker who supplies a crafted archive can make files land outside the intended directory.","audience":"developers","category":"package","nicknames":[],"who_cares":["flow-core-x","java","flowci","ci"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"files written outside the extraction directory, possibly overwriting others","analyst_note":"Confirm whether a fixed version exists and whether the exploit is public; the vendor did not respond, so check the project repository for a patch.","how_to_check":"- Check the installed flow-core-x version against `1.23.49`\n- Look for FileHelper.unzip in common/src/main/java/com/flowci/common/helper/FileHelper.java and confirm whether it is reached with untrusted archives","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-zip-input"],"who_is_affected":"Applications that embed flow-core-x and extract zip archives supplied from outside, such as uploads or pipeline inputs, are exposed. Deployments that never extract untrusted archives can skip it. The sources do not describe an upstream fix; the vendor did not respond to disclosure.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000738,"input_tokens":4608,"output_tokens":555,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124329':16A,19A '-2026':15A,18A '1.23.49':35B,75C 'archiv':46B,54B 'associ':105C 'attack':49B,94C,108C 'ci':20B 'common/src/main/java/com/flowci/common/helper/filehelper.java':86C 'complex':102C 'contact':128C 'core':4A,23B,31B,71C 'could':122C 'craft':53B 'cve':14A,17A 'difficult':114C 'directori':62B 'disclosur':132C 'earli':129C 'element':78C 'exploit':110C,116C 'extract':7A,44B 'file':11A,57B,85C 'filehelper.unzip':42B,82C 'flaw':40B 'flow':3A,22B,30B,70C 'flow-core-x':2A,21B,29B,69C 'flowci':1A,25B,28B,68C 'found':66C 'function':81C 'high':101C 'impact':77C 'intend':61B 'java':26B 'land':58B 'level':103C 'made':119C 'make':56B 'manipul':88C 'may':95C 'outsid':12A,59B 'packag':27B 'path':8A,38B,91C 'perform':97C 'public':120C 'regard':112C 'remot':48B,99C 'respond':136C 'result':89C 'suppli':51B 'target':13A 'travers':9A,39B,92C 'use':124C 'vendor':126C 'vulner':64C 'way':139C 'write':10A 'x':5A,24B,32B,72C 'zip':6A,45B","nicknames":[],"mitigations":[],"who_affected":"Applications that embed flow-core-x and extract zip archives supplied from outside, such as uploads or pipeline inputs, are exposed. Deployments that never extract untrusted archives can skip it. The sources do not describe an upstream fix; the vendor did not respond to disclosure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ci","flowci","flowcorex","java","medium","package"],"campaign_type":null,"search_a":"'-124329':16A,19A '-2026':15A,18A 'core':4A 'cve':14A,17A 'extract':7A 'file':11A 'flow':3A 'flow-core-x':2A 'flowci':1A 'outsid':12A 'path':8A 'target':13A 'travers':9A 'write':10A 'x':5A 'zip':6A","search_b":"'1.23.49':35B 'archiv':46B,54B 'attack':49B 'ci':20B 'core':23B,31B 'craft':53B 'directori':62B 'extract':44B 'file':57B 'filehelper.unzip':42B 'flaw':40B 'flow':22B,30B 'flow-core-x':21B,29B 'flowci':25B,28B 'intend':61B 'java':26B 'land':58B 'make':56B 'outsid':59B 'packag':27B 'path':38B 'remot':48B 'suppli':51B 'travers':39B 'x':24B,32B 'zip':45B","search_c":"'1.23.49':75C 'associ':105C 'attack':94C,108C 'common/src/main/java/com/flowci/common/helper/filehelper.java':86C 'complex':102C 'contact':128C 'core':71C 'could':122C 'difficult':114C 'disclosur':132C 'earli':129C 'element':78C 'exploit':110C,116C 'file':85C 'filehelper.unzip':82C 'flow':70C 'flow-core-x':69C 'flowci':68C 'found':66C 'function':81C 'high':101C 'impact':77C 'level':103C 'made':119C 'manipul':88C 'may':95C 'path':91C 'perform':97C 'public':120C 'regard':112C 'remot':99C 'respond':136C 'result':89C 'travers':92C 'use':124C 'vendor':126C 'vulner':64C 'way':139C 'x':72C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T12:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124329","severity":null,"published_at":"2026-11-08T12:17:48+00:00","modified_at":"2026-11-08T12:17:49+00:00","first_seen_at":"2026-11-08T12:47:40+00:00","fetched_at":"2026-11-08T12:47:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}