EUVD-2026-50473
GHSA-2956-977x-2w3r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Unauthenticated network write with no interaction (AV:N/AC:L/PR:N/UI:N); escaping FLYTO_SANDBOX_DIR to the host filesystem is a scope change (S:C); write-only so C:N, but arbitrary overwrite gives I:H/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir instead of validate_path_with_env_config and its FLYTO_SANDBOX_DIR confinement, allowing attacker-controlled response bytes to be written to arbitrary filesystem paths the process can access. This issue is fixed in version 2.26.6.
AnalysisAI
Arbitrary file write in flytohub Flyto Core (the execution kernel for automation and AI-agent workflows) prior to 2.26.6 lets attacker-influenced response bytes be written to any filesystem path the process can reach, because image.download and sibling file-writing modules trust a caller-controlled output_dir instead of routing it through validate_path_with_env_config and the FLYTO_SANDBOX_DIR sandbox. The flaw carries a CVSS 10.0 (scope-changed, high integrity and availability impact) and is fixed in v2.26.6. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a running flyto-core (< 2.26.6) workflow that invokes a file-writing module - image.download, document/excel_write, document/pdf_fill_form, or the browser/pagination checkpoint writer - with an output_dir/path that an attacker can influence, plus attacker control over the fetched response bytes (e.g., a caller-supplied download URL). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H = 10.0) rates this maximally severe: network, low-complexity, unauthenticated, scope-changed integrity and availability impact via arbitrary write outside the sandbox. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can influence a flyto-core workflow's image.download step supplies a malicious source URL and an output_dir that traverses out of the sandbox (e.g., ../../etc or a startup/config directory). The engine fetches the attacker's response bytes and writes them verbatim to that path with the process's privileges, letting the attacker overwrite configuration, drop a script into an auto-executed location, or corrupt files for denial of service. … |
| Remediation | Vendor-released patch: 2.26.6 - upgrade flyto-core to v2.26.6 or later, which routes image.download and the other file-writing modules through validate_path_with_env_config so writes are confined to FLYTO_SANDBOX_DIR (see release https://github.com/flytohub/flyto-core/releases/tag/v2.26.6 and advisory GHSA-2956-977x-2w3r). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems running Flyto Core versions prior to 2.26.6, assess external network exposure, and temporarily restrict access if immediate patching is not feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Flyto Core
View allSecret exfiltration in Flyto Core (flytohub/flyto-core) before 2.26.6 arises because the workflow-engine variable resolv
Unauthenticated SSRF and secret exfiltration in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets remote attackers c
Sensitive credential exposure in Flyto Core (flytohub/flyto-core) prior to 2.26.6 lets a remote actor exfiltrate the ope
Server-side request forgery in Flyto Core (flytohub/flyto-core) prior to 2.26.7 lets a low-privileged workflow author co
Server-side request forgery in Flyto Core (flyto-core), an execution kernel for automation and AI-agent workflows, allow
Server-side request forgery guard bypass in Flyto Core (flyto-core) versions up to and including 2.27.0 allows authentic
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today