Dashboard / CVE-2026-124509

CVE-2026-124509

MEDIUM
MEDIUM Priority: 0.03 BB Relevance: 71/100
Published: 2026-11-09 Modified: 2026-11-09 First seen: 2026-11-09 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: Low
VI: Low
VA: Low

Description

A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulation of the argument BucketARN leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. The name of the patch is b986b95074ef524019be7af51e1df172e48faa4b. You should upgrade the affected component.

Weakness Classification (1)

Affected Software (4)

VendorProductVersion
floci-io Floci 2.0
floci-io Floci 2.1.0
floci-io Floci 2.0
floci-io Floci 2.1.0

References & Advisories (9)

https://vuldb.com/vuln/432813
vdb-entry technical-description
https://vuldb.com/submit/1035485
third-party-advisory
https://vuldb.com/vuln/432813/cti
signature permissions-required

Bug Bounty Relevance

71 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

5.5 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.52%
Raw Score 0.005190
Percentile 44.6%
Date 2026-11-12

EPSS Trend

2026-11-12
0.00519
2026-11-10
0.00519
2026-11-09
0.00519

Intelligence Sources

mitre ref →
nvd ref →

External Links