CVE-2026-124330 | FlowCI flow-core-x up to 1.23.49 LocalFileManager LocalFileManager.java exist/save/read/remove fileName path traversal

November 7, 2026 Yanac

A vulnerability was found in FlowCI flow-core-x up to 1.23.49. It has been rated as problematic. This affects the function exist/save/read/remove of the file store/src/main/java/com/flowci/store/LocalFileManager.java of the component LocalFileManager. This manipulation of the argument fileName causes path traversal.

The identification of this vulnerability is CVE-2026-124330. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More