Skip to content
Fencer Vulns
high 7.3

CVE-2026-124509 json

floci-io Floci S3 Destination Configuration DeliveryStreamDescription.java S3Destination.bucketName path traversal

published 2026-11-09 55 min ago modified 2026-11-09 8 min ago

cvss
7.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulation of the argument BucketARN leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. The name of the patch is b986b95074ef524019be7af51e1df172e48faa4b. You should upgrade the affected component.

Patch / fix

  • floci-io Floci 2.2.0

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA 3.0 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CNA 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C
CNA 4.0 5.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CNA 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • floci-io Floci

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.