CVE-2026-124508 | floci-io Floci up to 2.4.0 Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts buildspecOverride.artifacts.base-directory path traversal (GHSA-4hjc-ww34-35c4)

November 8, 2026 Yanac

A vulnerability, which was classified as problematic, has been found in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJsonHandler.java of the component Artifact Handler. This manipulation of the argument buildspecOverride.artifacts.base-directory causes path traversal.

This vulnerability is handled as CVE-2026-124508. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More