---
id: "CVE-2026-124329"
page: "https://infrastack.ai/live/CVE-2026-124329"
kind: "vulnerability"
aliases: ["CVE-2026-124329"]
title: "FlowCI flow-core-x: zip extraction path traversal writes files outside target"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ci", "flow-core-x", "flowci", "java", "package"]
not_affected_if: ["no-untrusted-zip-input"]
published_at: "2026-11-08T12:17:48+00:00"
first_seen_at: "2026-11-08T12:47:40+00:00"
updated_at: "2026-11-08T12:49:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124329", "first_seen_at": "2026-11-08T12:47:40+00:00"}]
exploit_sources: []
---

# FlowCI flow-core-x: zip extraction path traversal writes files outside target

Link for people: https://infrastack.ai/live/CVE-2026-124329 (this .md is for agents)

FlowCI flow-core-x up to 1.23.49 has a path traversal flaw in FileHelper.unzip, which extracts zip archives. A remote attacker who supplies a crafted archive can make files land outside the intended directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed flow-core-x version against `1.23.49`
- Look for FileHelper.unzip in common/src/main/java/com/flowci/common/helper/FileHelper.java and confirm whether it is reached with untrusted archives

## Timeline

- 2026-11-08T12:47:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124329

## From the sources

A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the function FileHelper.unzip of the file common/src/main/java/com/flowci/common/helper/FileHelper.java. The manipulation results in path traversal. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_