CVE-2026-81743: Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection
Affected versions of Flowintel allow the LOGFILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory.
Because the application constructs the log destination from this configurable value, an administrator could set LOGFILE to an arbitrary filesystem path. Since attackers can influence logged content, this enables controlled data to be written into unintended files. The upstream commit specifically describes an exploitation chain in which an attacker injects a template into a chosen file and subsequently abuses application rendering behavior to execute code.
The patch removes LOGFILE from the web-editable settings, introduces validatelogfilename() to reject absolute paths, traversal, Windows paths, null bytes, and directory components, and centralizes log path construction through resolvelogfilepath().
Version impacted: >=3.3.0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowintelto a version that resolves this vulnerability.Fixed in 3.3.0 - Configuration
Remove LOG_FILE from the web-editable/system settings so it cannot be modified via system settings; apply the change described as part of the patch for the affected versions (>=3.3.0).
Flowintel LOG_FILE = removed from web-editable settings - Configuration
Implement validate_log_file_name() so LOG_FILE values are rejected when they are absolute paths, path traversal inputs, Windows paths, contain null bytes, or include directory components.
Flowintel validate_log_file_name() = enable validation - Configuration
Centralize log path construction through resolve_log_file_path() so the application derives the final log destination only through the validated resolver logic.
Flowintel resolve_log_file_path() = use centralized log path construction - Compensating control
Limit the ability for attackers to influence logged content (e.g., ensure template/input rendering that affects logs is not attacker-controlled) to reduce the risk of the described template injection exploitation chain.
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Deployments running Flowintel version 3.3.0 or later are affected when an administrator can modify system settings. Exploitation also depends on an attacker being able to influence content that Flowintel writes to its logs and on the relevant application rendering behavior being reachable.
What access or conditions are required for the exploit chain?
An administrator must set LOG_FILE to an arbitrary filesystem path through the system settings. An attacker can then supply controlled logged data to write a template into that chosen location, after which application rendering behavior may process it and execute code.
How can I determine whether an instance is exposed before patching?
Check whether the deployment is version 3.3.0 or later and whether LOG_FILE remains editable through web-based system settings. Review the configured value for absolute paths, traversal sequences, Windows-style paths, null bytes, or directory components rather than a simple log filename.
What should be changed if the update cannot be applied immediately?
Remove or restrict web access to editing LOG_FILE, and ensure its value is limited to a filename within the intended log directory. Do not allow absolute paths, traversal, Windows paths, null bytes, or directory components.