CVE-2026-124508: floci-io Floci Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts path traversal
A vulnerability was determined in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJsonHandler.java of the component Artifact Handler. This manipulation of the argument buildspecOverride.artifacts.base-directory causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
floci-io Floci versions up to and including 2.4.0 are identified as affected. The issue is in the Artifact Handler's processing of buildspec artifact base-directory values.
What does an attacker need to exploit this issue?
The vulnerable buildspecOverride.artifacts.base-directory argument must be manipulable by the attacker. The vulnerability is remotely exploitable and requires no privileges or user interaction according to the supplied CVSS vector.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
What can be done if no vendor response or fix is available?
Restrict who can supply or modify buildspec overrides, especially the artifacts.base-directory value. Validate and constrain that value so it cannot traverse outside the intended artifact directory.