CVE-2026-124330 · Other
NO FIX YET
FlowCI flow-core-x up to version 1.23.49 does not sanitize the fileName argument in its LocalFileManager, so a crafted name can escape the intended storage directory. An attacker can then check, read, write or delete files elsewhere on the server.
first public Nov 8, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running FlowCI flow-core-x up to 1.23.49 that expose its file store functions over the network. The flaw sits in the exist, save, read and remove operations of LocalFileManager, so exposure depends on whether those operations are reachable from outside. Sources do not say which deployments are reachable.
Not affected if file-store-not-exposed, version-above-1.23.49
Who cares flow-core-x, flowci, java, self-hosted
1.23.49store/src/main/java/com/flowci/store/LocalFileManager.java in the deployed source and see whether fileName is validated before useNo fix yet, per the sources.
A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the file store/src/main/java/com/flowci/store/LocalFileManager.java of the component LocalFileManager. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.