CVE-2026-124508

MEDIUM 5.3

floci-io Floci Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts path traversal

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJsonHandler.java of the component Artifact Handler. This manipulation of the argument buildspecOverride.artifacts.base-directory causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-22
Vendor	floci-io
Product	floci
Published	Nov 9, 2026

Stay Ahead of the Next One

Get instant alerts for floci-io floci

Be the first to know when new medium vulnerabilities affecting floci-io floci are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

floci-io / Floci

2.0 2.1 2.2 2.3 2.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/432812 vuldb.com: https://vuldb.com/vuln/432812/cti vuldb.com: https://vuldb.com/cve/CVE-2026-124508 vuldb.com: https://vuldb.com/submit/1035484 github.com: https://github.com/Floci-io/Floci/security/advisories/GHSA-4hjc-ww34-35c4 github.com: https://github.com/Floci-io/Floci/

Credits

🔍 lucasg2g (VulDB User) VulDB CNA Team