Search
Find a vulnerability
Search criteria
3 vulnerabilities found for Floci by floci-io
CVE-2026-124509 (GCVE-0-2026-124509)
Vulnerability from cvelistv5 – Published: 2026-11-09 01:30 – Updated: 2026-11-09 14:08 X_Open Source
VLAI
EPSS
VEX
Title
floci-io Floci S3 Destination Configuration DeliveryStreamDescription.java S3Destination.bucketName path traversal
Summary
A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulation of the argument BucketARN leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. The name of the patch is b986b95074ef524019be7af51e1df172e48faa4b. You should upgrade the affected component.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 14:08 UTC
CWE
- CWE-22 - Path Traversal
Assigner
VulDB
CNA
References
9 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432813 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432813/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124509 | third-party-advisory |
| https://vuldb.com/submit/1035485 | third-party-advisory |
| https://github.com/floci-io/floci/issues/4281 | issue-tracking |
| https://github.com/floci-io/floci/pull/4289 | issue-trackingpatch |
| https://github.com/floci-io/floci/commit/b986b950… | patch |
| https://github.com/floci-io/floci/releases/tag/2.2.0 | patch |
| https://github.com/floci-io/floci/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124509",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T14:08:12.875692Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T14:08:39.870Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/floci-io/floci/issues/4281"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:floci-io:floci:*:*:*:*:*:*:*:*"
],
"modules": [
"S3 Destination Configuration Handler"
],
"product": "Floci",
"vendor": "floci-io",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1.0"
},
{
"status": "unaffected",
"version": "2.2.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lucasg2g (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulation of the argument BucketARN leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. The name of the patch is b986b95074ef524019be7af51e1df172e48faa4b. You should upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T01:30:29.218Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432813 | floci-io Floci S3 Destination Configuration DeliveryStreamDescription.java S3Destination.bucketName path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432813"
},
{
"name": "VDB-432813 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432813/cti"
},
{
"name": "CVE-2026-124509 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124509"
},
{
"name": "Submit #1035485 | floci-io Floci (local AWS emulator) 2.0.1 (the released tag `2.0.1` carries the same `DeliveryStreamDescription`, `FirehoseService`, `S3Service` and `S3CfnProvisioner` code; reviewed at commit a5ab1672f9305299e3b7a32d67ce12b1d89f1199, the 2.0.1 head) Path",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035485"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/floci-io/floci/issues/4281"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/floci-io/floci/pull/4289"
},
{
"tags": [
"patch"
],
"url": "https://github.com/floci-io/floci/commit/b986b95074ef524019be7af51e1df172e48faa4b"
},
{
"tags": [
"patch"
],
"url": "https://github.com/floci-io/floci/releases/tag/2.2.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/floci-io/floci/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T12:01:04.000Z",
"value": "VulDB entry last update"
}
],
"title": "floci-io Floci S3 Destination Configuration DeliveryStreamDescription.java S3Destination.bucketName path traversal",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124509",
"datePublished": "2026-11-09T01:30:29.218Z",
"dateReserved": "2026-11-08T10:55:59.299Z",
"dateUpdated": "2026-11-09T14:08:39.870Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-124508 (GCVE-0-2026-124508)
Vulnerability from cvelistv5 – Published: 2026-11-09 01:15 – Updated: 2026-11-10 17:52
VLAI
EPSS
VEX
Title
floci-io Floci Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts path traversal
Summary
A vulnerability was determined in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJsonHandler.java of the component Artifact Handler. This manipulation of the argument buildspecOverride.artifacts.base-directory causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 16:29 UTC
CWE
- CWE-22 - Path Traversal
Assigner
VulDB
CNA
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/432812 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/432812/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-124508 | third-party-advisory |
| https://vuldb.com/submit/1035484 | third-party-advisory |
| https://github.com/Floci-io/Floci/security/adviso… | broken-link |
| https://github.com/Floci-io/Floci/ | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-124508",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T16:29:44.671069Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T17:52:58.371Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:floci-io:floci:*:*:*:*:*:*:*:*"
],
"modules": [
"Artifact Handler"
],
"product": "Floci",
"vendor": "floci-io",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2"
},
{
"status": "affected",
"version": "2.3"
},
{
"status": "affected",
"version": "2.4.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lucasg2g (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJsonHandler.java of the component Artifact Handler. This manipulation of the argument buildspecOverride.artifacts.base-directory causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Path Traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T01:15:23.149Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-432812 | floci-io Floci Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts path traversal",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/432812"
},
{
"name": "VDB-432812 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/432812/cti"
},
{
"name": "CVE-2026-124508 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-124508"
},
{
"name": "Submit #1035484 | floci-io Floci (local AWS emulator) 2.0.1 (the released tag `2.0.1` carries the same `BuildspecParser.parseArtifacts` and `CodeBuildRunner.uploadArtifacts` code; reviewed at commit a5ab1672f9305299e3b7a32d67ce12b1d89f1199, the 2.0.1 head) Path traversal /",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1035484"
},
{
"tags": [
"broken-link"
],
"url": "https://github.com/Floci-io/Floci/security/advisories/GHSA-4hjc-ww34-35c4"
},
{
"tags": [
"product"
],
"url": "https://github.com/Floci-io/Floci/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-08T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-08T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-08T11:58:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "floci-io Floci Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts path traversal",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-124508",
"datePublished": "2026-11-09T01:15:23.149Z",
"dateReserved": "2026-11-08T10:53:42.109Z",
"dateUpdated": "2026-11-10T17:52:58.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108598 (GCVE-0-2026-108598)
Vulnerability from cvelistv5 – Published: 2026-10-10 18:58 – Updated: 2026-10-13 11:41
VLAI
EPSS
VEX
Title
Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates
Summary
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 11:39 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
VulnCheck
CNA
References
7 references
| URL | Tags |
|---|---|
| https://github.com/floci-io/floci/security/adviso… | vendor-advisory |
| https://github.com/ghostx-86/exploitarium/tree/ma… | exploit |
| https://github.com/floci-io/floci/commit/144b90e6… | patch |
| https://github.com/floci-io/floci/releases/tag/2.2.0 | release-notes |
| https://github.com/floci-io/floci/blob/560b3e4aae… | technical-description |
| https://github.com/floci-io/floci | product |
| https://www.vulncheck.com/advisories/floci-1.1.0-… | third-party-advisory |
Impacted products
Date Public
2026-06-27 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108598",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T11:39:38.007624Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T11:41:41.376Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/floci-io/floci",
"product": "floci",
"repo": "https://github.com/floci-io/floci",
"vendor": "floci-io",
"versions": [
{
"lessThan": "2.2.0",
"status": "affected",
"version": "1.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhammad Ali"
},
{
"lang": "en",
"type": "finder",
"value": "Hasan Anwar"
},
{
"lang": "en",
"type": "finder",
"value": "Wael-Rd"
}
],
"datePublic": "2026-06-27T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T18:58:14.825Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3p4c-wp7w-mgjx)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/floci-io/floci/security/advisories/GHSA-3p4c-wp7w-mgjx"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/ghostx-86/exploitarium/tree/main/floci-apigateway-vtl-rce-poc"
},
{
"tags": [
"patch"
],
"url": "https://github.com/floci-io/floci/commit/144b90e6fa861a5ac882e99a090d503da01945c4"
},
{
"name": "floci 2.2.0 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/floci-io/floci/releases/tag/2.2.0"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/floci-io/floci/blob/560b3e4aae61cea3ac7d4d51843bdffd0e3085fd/src/main/java/io/github/hectorvent/floci/services/apigateway/VtlTemplateEngine.java#L74-L114"
},
{
"tags": [
"product"
],
"url": "https://github.com/floci-io/floci"
},
{
"name": "VulnCheck Advisory: Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/floci-1.1.0-before-2.2.0-rce-via-api-gateway-vtl-mapping-templates"
}
],
"title": "Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108598",
"datePublished": "2026-10-10T18:58:14.825Z",
"dateReserved": "2026-10-10T18:25:14.522Z",
"dateUpdated": "2026-10-13T11:41:41.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}