Description
A vulnerability was determined in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJsonHandler.java of the component Artifact Handler. This manipulation of the argument buildspecOverride.artifacts.base-directory causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| floci-io | Floci | 2.0, 2.1, 2.2, 2.3, 2.4.0 | — |
References
- VDB-432812 | floci-io Floci Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts path traversal vdb-entry technical-description
- VDB-432812 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-124508 | CVE Analysis and Report third-party-advisory
- Submit #1035484 | floci-io Floci (local AWS emulator) 2.0.1 (the released tag `2.0.1` carries the same `BuildspecParser.parseArtifacts` and `CodeBuildRunner.uploadArtifacts` code; reviewed at commit a5ab1672f9305299e3b7a32d67ce12b1d89f1199, the 2.0.1 third-party-advisory
- https://github.com/Floci-io/Floci/security/advisories/GHSA-4hjc-ww34-35c4 broken-link
- https://github.com/Floci-io/Floci/ product