---
id: "CVE-2026-124330"
page: "https://infrastack.ai/live/CVE-2026-124330"
kind: "vulnerability"
aliases: ["CVE-2026-124330"]
title: "FlowCI flow-core-x: path traversal in local file store lets attackers reach other files"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["flow-core-x", "flowci", "java", "other", "self-hosted"]
not_affected_if: ["file-store-not-exposed", "version-above-1.23.49"]
published_at: "2026-11-08T13:16:33+00:00"
first_seen_at: "2026-11-08T13:17:48+00:00"
updated_at: "2026-11-08T13:18:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124330", "first_seen_at": "2026-11-08T13:17:48+00:00"}]
exploit_sources: []
---

# FlowCI flow-core-x: path traversal in local file store lets attackers reach other files

Link for people: https://infrastack.ai/live/CVE-2026-124330 (this .md is for agents)

FlowCI flow-core-x up to version 1.23.49 does not sanitize the fileName argument in its LocalFileManager, so a crafted name can escape the intended storage directory. An attacker can then check, read, write or delete files elsewhere on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed flow-core-x version against `1.23.49`
- Look for `store/src/main/java/com/flowci/store/LocalFileManager.java` in the deployed source and see whether fileName is validated before use

## Timeline

- 2026-11-08T13:17:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124330

## From the sources

A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the file store/src/main/java/com/flowci/store/LocalFileManager.java of the component LocalFileManager. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_