CVE-2026-124330
LOW
INFO
Priority: 0.00
BB Relevance:
53/100
Published: 2026-11-08
Modified: 2026-11-09
First seen: 2026-11-08
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
Low
UI:
None
S:
X
AT:
None
VC:
Low
VI:
Low
VA:
Low
Description
A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the file store/src/main/java/com/flowci/store/LocalFileManager.java of the component LocalFileManager. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Weakness Classification (1)
Affected Software (100)
| Vendor | Product | Version |
|---|---|---|
| FlowCI | flow-core-x | 1.23.0 |
| FlowCI | flow-core-x | 1.23.1 |
| FlowCI | flow-core-x | 1.23.2 |
| FlowCI | flow-core-x | 1.23.3 |
| FlowCI | flow-core-x | 1.23.4 |
| FlowCI | flow-core-x | 1.23.5 |
| FlowCI | flow-core-x | 1.23.6 |
| FlowCI | flow-core-x | 1.23.7 |
| FlowCI | flow-core-x | 1.23.8 |
| FlowCI | flow-core-x | 1.23.9 |
| FlowCI | flow-core-x | 1.23.10 |
| FlowCI | flow-core-x | 1.23.11 |
| FlowCI | flow-core-x | 1.23.12 |
| FlowCI | flow-core-x | 1.23.13 |
| FlowCI | flow-core-x | 1.23.14 |
| FlowCI | flow-core-x | 1.23.15 |
| FlowCI | flow-core-x | 1.23.16 |
| FlowCI | flow-core-x | 1.23.17 |
| FlowCI | flow-core-x | 1.23.18 |
| FlowCI | flow-core-x | 1.23.19 |
| FlowCI | flow-core-x | 1.23.20 |
| FlowCI | flow-core-x | 1.23.21 |
| FlowCI | flow-core-x | 1.23.22 |
| FlowCI | flow-core-x | 1.23.23 |
| FlowCI | flow-core-x | 1.23.24 |
| FlowCI | flow-core-x | 1.23.25 |
| FlowCI | flow-core-x | 1.23.26 |
| FlowCI | flow-core-x | 1.23.27 |
| FlowCI | flow-core-x | 1.23.28 |
| FlowCI | flow-core-x | 1.23.29 |
Showing 30 of 100 entries
References & Advisories (5)
vdb-entry
technical-description
third-party-advisory
third-party-advisory
signature
permissions-required
exploit