{"id":"CVE-2026-124330","kind":"vulnerability","aliases":["CVE-2026-124330"],"related":[],"title":"FlowCI flow-core-x: path traversal in local file store lets attackers reach other files","description":"A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the file store/src/main/java/com/flowci/store/LocalFileManager.java of the component LocalFileManager. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"FlowCI flow-core-x up to version 1.23.49 does not sanitize the fileName argument in its LocalFileManager, so a crafted name can escape the intended storage directory. An attacker can then check, read, write or delete files elsewhere on the server.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["flow-core-x","flowci","java","other","self-hosted"],"not_affected_if":["file-store-not-exposed","version-above-1.23.49"],"how_to_check":"- Check the installed flow-core-x version against `1.23.49`\n- Look for `store/src/main/java/com/flowci/store/LocalFileManager.java` in the deployed source and see whether fileName is validated before use","fix":null,"status":"open","published_at":"2026-11-08T13:16:33+00:00","first_seen_at":"2026-11-08T13:17:48+00:00","triaged_at":"2026-11-08T13:18:51+00:00","updated_at":"2026-11-08T13:18:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-08T13:18:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FlowCI flow-core-x: path traversal in local file store lets attackers reach other files","impact":"medium","summary":"FlowCI flow-core-x up to version 1.23.49 does not sanitize the fileName argument in its LocalFileManager, so a crafted name can escape the intended storage directory. An attacker can then check, read, write or delete files elsewhere on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["flowci","flow-core-x","self-hosted","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker reads or deletes arbitrary files on the server","analyst_note":"Check the NVD entry and the FlowCI repository for a fixed release and whether the vendor has responded; sources say the vendor did not respond.","how_to_check":"- Check the installed flow-core-x version against `1.23.49`\n- Look for `store/src/main/java/com/flowci/store/LocalFileManager.java` in the deployed source and see whether fileName is validated before use","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-above-1.23.49","file-store-not-exposed"],"who_is_affected":"Teams running FlowCI flow-core-x up to 1.23.49 that expose its file store functions over the network. The flaw sits in the exist, save, read and remove operations of LocalFileManager, so exposure depends on whether those operations are reachable from outside. Sources do not say which deployments are reachable.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4635,"output_tokens":575,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124330':19A,22A '-2026':18A,21A '1.23.49':41B,87C 'affect':89C 'argument':47B,105C 'attack':13A,62B,116C,127C 'caus':107C 'check':65B 'complex':122C 'compon':99C 'contact':147C 'core':4A,25B,36B,83C 'craft':53B 'cve':17A,20A 'degre':120C 'delet':69B 'determin':78C 'difficult':133C 'directori':60B 'disclos':139C 'disclosur':151C 'earli':148C 'elsewher':71B 'escap':56B 'exist/save/read/remove':92C 'exploit':129C,135C 'file':10A,16A,70B,95C 'filenam':46B,106C 'flow':3A,24B,35B,82C 'flow-core-x':2A,23B,34B,81C 'flowci':1A,27B,33B,80C 'function':91C 'high':119C 'host':32B 'initi':114C 'intend':58B 'java':28B 'let':12A 'local':9A 'localfilemanag':50B,100C 'manipul':102C 'may':141C 'name':54B 'need':124C 'path':6A,108C 'possibl':112C 'public':138C 'reach':14A 'read':66B 'remot':117C 'report':131C 'respond':155C 'sanit':44B 'self':31B 'self-host':30B 'server':74B 'storag':59B 'store':11A 'store/src/main/java/com/flowci/store/localfilemanager.java':96C 'travers':7A,109C 'util':143C 'vendor':145C 'version':40B 'vulner':76C 'way':158C 'write':67B 'x':5A,26B,37B,84C","nicknames":[],"mitigations":[],"who_affected":"Teams running FlowCI flow-core-x up to 1.23.49 that expose its file store functions over the network. The flaw sits in the exist, save, read and remove operations of LocalFileManager, so exposure depends on whether those operations are reachable from outside. Sources do not say which deployments are reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["flowci","flowcorex","java","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-124330':19A,22A '-2026':18A,21A 'attack':13A 'core':4A 'cve':17A,20A 'file':10A,16A 'flow':3A 'flow-core-x':2A 'flowci':1A 'let':12A 'local':9A 'path':6A 'reach':14A 'store':11A 'travers':7A 'x':5A","search_b":"'1.23.49':41B 'argument':47B 'attack':62B 'check':65B 'core':25B,36B 'craft':53B 'delet':69B 'directori':60B 'elsewher':71B 'escap':56B 'file':70B 'filenam':46B 'flow':24B,35B 'flow-core-x':23B,34B 'flowci':27B,33B 'host':32B 'intend':58B 'java':28B 'localfilemanag':50B 'name':54B 'read':66B 'sanit':44B 'self':31B 'self-host':30B 'server':74B 'storag':59B 'version':40B 'write':67B 'x':26B,37B","search_c":"'1.23.49':87C 'affect':89C 'argument':105C 'attack':116C,127C 'caus':107C 'complex':122C 'compon':99C 'contact':147C 'core':83C 'degre':120C 'determin':78C 'difficult':133C 'disclos':139C 'disclosur':151C 'earli':148C 'exist/save/read/remove':92C 'exploit':129C,135C 'file':95C 'filenam':106C 'flow':82C 'flow-core-x':81C 'flowci':80C 'function':91C 'high':119C 'initi':114C 'localfilemanag':100C 'manipul':102C 'may':141C 'need':124C 'path':108C 'possibl':112C 'public':138C 'remot':117C 'report':131C 'respond':155C 'store/src/main/java/com/flowci/store/localfilemanager.java':96C 'travers':109C 'util':143C 'vendor':145C 'vulner':76C 'way':158C 'x':84C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T13:16:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124330","severity":null,"published_at":"2026-11-08T13:16:33+00:00","modified_at":"2026-11-08T13:16:34+00:00","first_seen_at":"2026-11-08T13:17:48+00:00","fetched_at":"2026-11-08T13:17:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}