Flowintel CVE-2026-81659

Exploitation requires a valid Flowintel account with permission to create or edit notes and invoke the PDF export function. The attacker must be able to submit note content containing raw LaTeX block-level directives - the old escaping logic targeted special characters but did not strip \input{} or similar constructs. The XeLaTeX process must have read access to the target file; files outside the service account's permissions cannot be exfiltrated. Exploitation is limited by: authentication (PR:L - at minimum a low-privilege Flowintel account is required), the need to trigger PDF export rather than docx export (the docx path is a separate Pandoc invocation and is also now restricted), and server process filesystem permissions. There is no requirement for a non-default configuration - any Flowintel instance with PDF export enabled and the Pandoc/XeLaTeX toolchain present is vulnerable in its pre-patch state.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1, indicating a network-accessible, low-complexity attack requiring only a low-privilege account with no user interaction. Confidentiality impact is high on the vulnerable system; integrity and availability are unaffected, confirming this is a read-only server-side file exfiltration. No CISA KEV listing and no EPSS data are provided, so active exploitation is unconfirmed. The PR:L requirement meaningfully limits exposure - an external unauthenticated attacker cannot exploit this directly - but any authenticated Flowintel user, including low-trust analysts or compromised accounts, qualifies. The real-world severity is elevated above the score because Flowintel is deployed in security operations contexts where the server likely stores high-value data (threat intelligence, case notes, API keys, private credentials). The well-known nature of LaTeX injection for file read lowers the bar for exploitation once an attacker has credentials.

An authenticated Flowintel analyst creates or edits a note containing a raw LaTeX directive such as \verbatiminput{/etc/shadow} or \input{/app/config/secrets.py}. When PDF export is triggered for that note, Pandoc passes the raw LaTeX through to XeLaTeX, which reads the referenced file and renders its contents into the PDF. The attacker downloads the resulting PDF and recovers the server-side file contents. No public POC is known, but the technique is well-established and reproducible without specialized tools.