Path Traversal Vulnerability in Floci by floci-io
CVE-2026-124508

6.9MEDIUM

Key Information:

Vendor

Floci-io

Status
Floci
Vendor
CVE Published:
9 November 2026

What is CVE-2026-124508?

A vulnerability was discovered in Floci that affects versions up to 2.4.0. The issue resides in the BuildspecParser.parseArtifacts function, specifically within the CodeBuildJsonHandler.java component. The flaw lies in the handling of the buildspecOverride.artifacts.base-directory argument, which can lead to unauthorized access through path traversal. This vulnerability allows remote attackers to manipulate the base directory parameter, potentially exposing sensitive files within the system. Public disclosure of this vulnerability has occurred, and the vendor has not responded to initial notifications regarding the issue.

Affected Version(s)

Floci 2.0

Floci 2.1

Floci 2.2

References

https://vuldb.com/vuln/432812
vdb-entrytechnical-description
https://vuldb.com/vuln/432812/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-124508
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lucasg2g (VulDB User)
VulDB CNA Team
.