CVE-2026-124330
Full vulnerability record from the local CVENow database.
Description
A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the file store/src/main/java/com/flowci/store/LocalFileManager.java of the component LocalFileManager. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
LOW
CVSS score
1.3
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-11-08 13:16:33.400000
Last modified
2026-11-08 13:16:34.123000
View original CVE JSON
{
"id": "CVE-2026-124330",
"sourceIdentifier": "[email protected]",
"published": "2026-11-08T13:16:33.400",
"lastModified": "2026-11-08T13:16:34.123",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the file store/src/main/java/com/flowci/store/LocalFileManager.java of the component LocalFileManager. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "FlowCI",
"product": "flow-core-x",
"cpes": [
"cpe:2.3:a:flowci:flow-core-x:*:*:*:*:*:*:*:*"
],
"modules": [
"LocalFileManager"
],
"versions": [
{
"version": "1.23.0",
"status": "affected"
},
{
"version": "1.23.1",
"status": "affected"
},
{
"version": "1.23.2",
"status": "affected"
},
{
"version": "1.23.3",
"status": "affected"
},
{
"version": "1.23.4",
"status": "affected"
},
{
"version": "1.23.5",
"status": "affected"
},
{
"version": "1.23.6",
"status": "affected"
},
{
"version": "1.23.7",
"status": "affected"
},
{
"version": "1.23.8",
"status": "affected"
},
{
"version": "1.23.9",
"status": "affected"
},
{
"version": "1.23.10",
"status": "affected"
},
{
"version": "1.23.11",
"status": "affected"
},
{
"version": "1.23.12",
"status": "affected"
},
{
"version": "1.23.13",
"status": "affected"
},
{
"version": "1.23.14",
"status": "affected"
},
{
"version": "1.23.15",
"status": "affected"
},
{
"version": "1.23.16",
"status": "affected"
},
{
"version": "1.23.17",
"status": "affected"
},
{
"version": "1.23.18",
"status": "affected"
},
{
"version": "1.23.19",
"status": "affected"
},
{
"version": "1.23.20",
"status": "affected"
},
{
"version": "1.23.21",
"status": "affected"
},
{
"version": "1.23.22",
"status": "affected"
},
{
"version": "1.23.23",
"status": "affected"
},
{
"version": "1.23.24",
"status": "affected"
},
{
"version": "1.23.25",
"status": "affected"
},
{
"version": "1.23.26",
"status": "affected"
},
{
"version": "1.23.27",
"status": "affected"
},
{
"version": "1.23.28",
"status": "affected"
},
{
"version": "1.23.29",
"status": "affected"
},
{
"version": "1.23.30",
"status": "affected"
},
{
"version": "1.23.31",
"status": "affected"
},
{
"version": "1.23.32",
"status": "affected"
},
{
"version": "1.23.33",
"status": "affected"
},
{
"version": "1.23.34",
"status": "affected"
},
{
"version": "1.23.35",
"status": "affected"
},
{
"version": "1.23.36",
"status": "affected"
},
{
"version": "1.23.37",
"status": "affected"
},
{
"version": "1.23.38",
"status": "affected"
},
{
"version": "1.23.39",
"status": "affected"
},
{
"version": "1.23.40",
"status": "affected"
},
{
"version": "1.23.41",
"status": "affected"
},
{
"version": "1.23.42",
"status": "affected"
},
{
"version": "1.23.43",
"status": "affected"
},
{
"version": "1.23.44",
"status": "affected"
},
{
"version": "1.23.45",
"status": "affected"
},
{
"version": "1.23.46",
"status": "affected"
},
{
"version": "1.23.47",
"status": "affected"
},
{
"version": "1.23.48",
"status": "affected"
},
{
"version": "1.23.49",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 1.3,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.6,
"impactScore": 3.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:H/Au:S/C:P/I:P/A:P",
"baseScore": 4.6,
"accessVector": "NETWORK",
"accessComplexity": "HIGH",
"authentication": "SINGLE",
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"availabilityImpact": "PARTIAL"
},
"baseSeverity": "MEDIUM",
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"references": [
{
"url": "https://glacier-tarsal-711.notion.site/Flow-ci-Path-Traversal-in-flow-ci-LocalFileManager-via-Unsanitized-fileName-Parameter-3f7b25e24b368031bf2cc0afd9166896",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-124330",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/1027417",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/432650",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/432650/cti",
"source": "[email protected]"
}
]
}