Arbitrary File Path Modification in Flowintel Application

CVE-2026-81743

What is CVE-2026-81743?

Flowintel has a security flaw that permits the modification of the LOG_FILE configuration value, allowing it to reference arbitrary filesystem paths outside intended directories. This vulnerability can be exploited by attackers to manipulate log content or write malicious data into unauthorized files. The flaw arises from how the application constructs log file paths, which can lead to potential code execution if sensitive files are accessed or modified. The recent patch addresses this issue by removing LOG_FILE from editable settings and implementing strict validation to prevent unsafe path configurations.

References