Path Traversal Vulnerability in floci-io Floci S3 Destination Configuration

CVE-2026-124509

What is CVE-2026-124509?

A vulnerability exists in the S3 Destination Configuration Handler of floci-io Floci, specifically within the method S3Destination.bucketName. This vulnerability allows for path traversal attacks through manipulation of the BucketARN argument, which can be exploited remotely. Publicly available exploits make this vulnerability particularly concerning. Users are advised to upgrade to version 2.2.0, which contains a patch identified by commit b986b95074ef524019be7af51e1df172e48faa4b, to protect against possible exploitation.

References