{"id":"CVE-2026-124508","kind":"vulnerability","aliases":["CVE-2026-124508"],"related":[],"title":"Floci: path traversal in CodeBuild artifact handler lets remote callers escape directories","description":"A vulnerability was determined in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJsonHandler.java of the component Artifact Handler. This manipulation of the argument buildspecOverride.artifacts.base-directory causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Floci up to 2.4.0 fails to validate the artifacts base-directory field of a CodeBuild buildspec override, so a remote request can use path traversal to reach files outside the intended directory. The exploit has been publicly disclosed, and the vendor did not respond to early notice.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["codebuild","floci","java","other"],"not_affected_if":["localhost-only"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-09T02:16:58+00:00","first_seen_at":"2026-11-09T02:24:16+00:00","triaged_at":"2026-11-09T02:26:24+00:00","updated_at":"2026-11-09T02:26:24+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T02:26:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Floci: path traversal in CodeBuild artifact handler lets remote callers escape directories","impact":"medium","summary":"Floci up to 2.4.0 fails to validate the artifacts base-directory field of a CodeBuild buildspec override, so a remote request can use path traversal to reach files outside the intended directory. The exploit has been publicly disclosed, and the vendor did not respond to early notice.","audience":"businesses","category":"other","nicknames":[],"who_cares":["floci","codebuild","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"remote requests read or write files outside the intended artifact directory","analyst_note":"Confirm the fixed version (none stated; vendor did not respond) and whether the CodeBuild endpoint is on by default; check the linked GitHub advisory.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["localhost-only"],"who_is_affected":"Teams running Floci as a local AWS emulator with its CodeBuild service reachable over the network are the ones exposed. The sources do not say whether the default configuration exposes the CodeBuild endpoint or whether deployments limited to localhost are safe, so treat any reachable instance as potentially affected until checked.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4647,"output_tokens":502,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124508':15A,18A '-2026':14A,17A '2.4.0':25B,81C 'argument':100C 'artifact':6A,30B,94C 'attack':107C 'base':32B 'base-directori':31B 'buildspec':38B 'buildspecoverride.artifacts.base':101C 'buildspecparser.parseartifacts':86C 'caller':10A 'caus':103C 'codebuild':5A,19B,37B 'compon':93C 'contact':125C 'cve':13A,16A 'determin':73C 'directori':12A,33B,54B,102C 'disclos':60B,117C 'disclosur':129C 'earli':68B,126C 'escap':11A 'exploit':56B,113C 'fail':26B 'field':34B 'file':50B,89C 'floci':1A,20B,22B,76C,78C 'floci-io':75C 'function':85C 'handler':7A,95C 'impact':82C 'initi':110C 'intend':53B 'io':77C 'java':21B 'let':8A 'manipul':97C 'may':119C 'notic':69B 'outsid':51B 'overrid':39B 'path':2A,46B,104C 'public':59B,116C 'reach':49B 'remot':9A,42B,111C 'request':43B 'respond':66B,133C 'src/main/java/io/github/hectorvent/floci/services/codebuild/codebuildjsonhandler.java':90C 'travers':3A,47B,105C 'use':45B 'util':121C 'valid':28B 'vendor':63B,123C 'vulner':71C 'way':136C","nicknames":[],"mitigations":[],"who_affected":"Teams running Floci as a local AWS emulator with its CodeBuild service reachable over the network are the ones exposed. The sources do not say whether the default configuration exposes the CodeBuild endpoint or whether deployments limited to localhost are safe, so treat any reachable instance as potentially affected until checked.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["codebuild","floci","java","medium","other"],"campaign_type":null,"search_a":"'-124508':15A,18A '-2026':14A,17A 'artifact':6A 'caller':10A 'codebuild':5A 'cve':13A,16A 'directori':12A 'escap':11A 'floci':1A 'handler':7A 'let':8A 'path':2A 'remot':9A 'travers':3A","search_b":"'2.4.0':25B 'artifact':30B 'base':32B 'base-directori':31B 'buildspec':38B 'codebuild':19B,37B 'directori':33B,54B 'disclos':60B 'earli':68B 'exploit':56B 'fail':26B 'field':34B 'file':50B 'floci':20B,22B 'intend':53B 'java':21B 'notic':69B 'outsid':51B 'overrid':39B 'path':46B 'public':59B 'reach':49B 'remot':42B 'request':43B 'respond':66B 'travers':47B 'use':45B 'valid':28B 'vendor':63B","search_c":"'2.4.0':81C 'argument':100C 'artifact':94C 'attack':107C 'buildspecoverride.artifacts.base':101C 'buildspecparser.parseartifacts':86C 'caus':103C 'compon':93C 'contact':125C 'determin':73C 'directori':102C 'disclos':117C 'disclosur':129C 'earli':126C 'exploit':113C 'file':89C 'floci':76C,78C 'floci-io':75C 'function':85C 'handler':95C 'impact':82C 'initi':110C 'io':77C 'manipul':97C 'may':119C 'path':104C 'public':116C 'remot':111C 'respond':133C 'src/main/java/io/github/hectorvent/floci/services/codebuild/codebuildjsonhandler.java':90C 'travers':105C 'util':121C 'vendor':123C 'vulner':71C 'way':136C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T02:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124508","severity":null,"published_at":"2026-11-09T02:16:58+00:00","modified_at":"2026-11-09T02:16:59+00:00","first_seen_at":"2026-11-09T02:24:16+00:00","fetched_at":"2026-11-09T02:24:16+00:00","note":null}],"documents":[{"id":105238,"url":"https://github.com/Floci-io/Floci/security/advisories/GHSA-4hjc-ww34-35c4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}