CVE-2026-124329

FlowCI flow-core-x FileHelper.java FileHelper.unzip path traversal

View on CVE.org
Published Nov 8, 2026 CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Description
A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the function FileHelper.unzip of the file common/src/main/java/com/flowci/common/helper/FileHelper.java. The manipulation results in path traversal. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the function FileHelper.unzip of the file common/src/main/java/com/flowci/common/helper/FileHelper.java. The manipulation results in path traversal. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title FlowCI flow-core-x FileHelper.java FileHelper.unzip path traversal
First Time appeared Flowci
Flowci flow-core-x
Weaknesses CWE-22
CPEs cpe:2.3:a:flowci:flow-core-x:*:*:*:*:*:*:*:*
Vendors & Products Flowci
Flowci flow-core-x
References
Metrics cvssV2_0

{'score': 4.6, 'vector': 'AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 5, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 10, 2026, 5:56 PM
Reserved
Nov 7, 2026, 7:35 PM

View source JSON

Updated
Nov 10, 2026, 4:40 PM

JSON

Status
Deferred
Published
Nov 8, 2026, 12:17 PM
Modified
Nov 10, 2026, 6:17 PM

View source JSON

No data.

Updated
Nov 8, 2026, 4:15 PM

JSON