CVE-2026-124329
FlowCI flow-core-x FileHelper.java FileHelper.unzip path traversal
CVSS Score
5.0
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the function FileHelper.unzip of the file common/src/main/java/com/flowci/common/helper/FileHelper.java. The manipulation results in path traversal. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
| CWE | CWE-22 |
| Vendor | flowci |
| Product | flow-core-x |
| Published | Nov 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for flowci flow-core-x
Be the first to know when new medium vulnerabilities affecting flowci flow-core-x are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
FlowCI / flow-core-x
1.23.0 1.23.1 1.23.2 1.23.3 1.23.4 1.23.5 1.23.6 1.23.7 1.23.8 1.23.9 1.23.10 1.23.11 1.23.12 1.23.13 1.23.14 1.23.15 1.23.16 1.23.17 1.23.18 1.23.19 1.23.20 1.23.21 1.23.22 1.23.23 1.23.24 1.23.25 1.23.26 1.23.27 1.23.28 1.23.29 1.23.30 1.23.31 1.23.32 1.23.33 1.23.34 1.23.35 1.23.36 1.23.37 1.23.38 1.23.39 1.23.40 1.23.41 1.23.42 1.23.43 1.23.44 1.23.45 1.23.46 1.23.47 1.23.48 1.23.49
References
vuldb.com: https://vuldb.com/vuln/432649 vuldb.com: https://vuldb.com/vuln/432649/cti vuldb.com: https://vuldb.com/cve/CVE-2026-124329 vuldb.com: https://vuldb.com/submit/1027414 glacier-tarsal-711.notion.site: https://glacier-tarsal-711.notion.site/Flow-ci-ZipSlip-Path-Traversal-in-flow-ci-FileHelper-unzip-During-Job-Report-Extraction-3f7b25e24b3680a8b7cec8c15d79a2fb
Credits
🔍 Zy0t1 (VulDB User) VulDB CNA Team