EUVD-2026-119769
GHSA-9v55-g5pj-xwf7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Floci artifact-handling endpoint remotely
-
ExploitSubmit buildspecOverride with traversal in artifacts.base-directory
-
ExecutionparseArtifacts resolves path outside intended directory
-
ImpactRead files outside artifact scope
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to control a buildspec override - specifically the buildspecOverride.artifacts.base-directory argument processed by BuildspecParser.parseArtifacts in CodeBuildJsonHandler.java - in a deployment of floci-io Floci at version 2.4.0 or earlier. The vector (AV:N/PR:N/UI:N) indicates no authentication or user interaction is confirmed as required, so any component path that accepts an externally supplied buildspec artifacts configuration is reachable. Limiting factors: impact is confined to confidentiality (VC:L, with VI:N/VA:N), so this is a file-disclosure-class traversal rather than code execution or data tampering; realistic risk is further constrained by the product's very small deployment footprint; and the input does not describe the exact mechanism by which the base-directory value is reached, so whether a non-default configuration or an exposed submission path is needed is not specified in the available sources. |
| Impact | Signals are mixed and point to a low-to-moderate priority rather than an urgent one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated issue, but impact is deliberately narrow: VC:L with VI:N and VA:N, i.e. limited confidentiality exposure and no integrity or availability impact, consistent with a read-oriented path traversal (CWE-22). The input carries E:P (proof-of-concept exploit maturity) and states the exploit was publicly disclosed, but it is NOT in CISA KEV and no EPSS score is provided, so there is no evidence of active or widespread exploitation. VulDB's priority label is 'this_month', which aligns with a moderate, patch-in-routine-cycle posture rather than emergency action. The dominant risk-limiting factor is product obscurity: Floci is a small open-source Java project with minimal deployment footprint, so even a remote unauthenticated flaw has a small real-world attack surface. Note the vendor did not respond to disclosure, so an official patched version is not confirmed from the supplied data - a GitHub security advisory (GHSA-4hjc-ww34-35c4) exists but its fix content is not detailed in the input. |
| Exploit ScenarioDerived | A remote attacker submits a crafted buildspec override in which the artifacts.base-directory value contains directory-traversal sequences, causing Floci's BuildspecParser.parseArtifacts to resolve a path outside the intended artifact directory. Because no authentication is indicated by the vector (PR:N), the request can be sent remotely without credentials, and the narrow VC:L impact suggests exposure of files the process can read rather than code execution. A public PoC reference exists but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 09, 2026
Path traversal in the Floci CodeBuild emulator (floci-io Floci through 2.4.0) allows remote attackers to read files outside the intended artifact directory by supplying a crafted buildspecOverride.artifacts.base-directory value that is processed by BuildspecParser.parseArtifacts in CodeBuildJsonHandler.java. The assessed impact is confidentiality-only (C:L, with no integrity or availability effect), and the assessed vector indicates no authentication or user interaction is required, so any reachable path that accepts an externally supplied buildspec artifacts configuration is in scope. The CVE record states that exploit details have been publicly disclosed and may be used; that reference is not verified as working exploit code, CISA KEV does not list this issue, and the vendor reportedly did not respond to the report, so no fixed release version is identified.
RemediationAI
No vendor-released patch was identified at the time of analysis: the vendor was contacted about the disclosure and did not respond, and no fixed version is published in the available references, so operators should track GHSA-4hjc-ww34-35c4 (https://github.com/Floci-io/Floci/security/advisories/GHSA-4hjc-ww34-35c4) and the VulDB entry (https://vuldb.com/vuln/432812) for an update. Because the flaw is triggered by an externally supplied buildspecOverride.artifacts.base-directory value reaching BuildspecParser.parseArtifacts, the directly applicable interim controls are to reduce who can submit buildspec overrides to the CodeBuild handler - keep the emulator off untrusted networks or place authentication and request filtering in front of the endpoint that accepts buildspecOverride payloads, with the trade-off that legitimate callers from those networks or without credentials lose access - and, where the handler source can be modified locally, reject base-directory values containing parent-directory sequences or absolute paths and canonicalize against a fixed artifact root before resolution, at the cost that buildspecs legitimately referencing relative directories outside the default root will fail. Neither measure removes the underlying parsing weakness, and since the assessed impact is limited to file disclosure (C:L), any file readable by the Floci process remains exposed wherever the vulnerable handler stays reachable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Floci is a Java implementation that emulates AWS CodeBuild; the affected component is its Artifact Handler, specifically CodeBuildJsonHandler.java, where JSON buildspec overrides are deserialized and dispatched to BuildspecParser.parseArtifacts. The buildspecOverride.artifacts.base-directory field is a user-supplied path prefix that the parser uses when resolving where build artifacts are written or read, and because that value is not constrained to the intended artifact root, the parse can resolve to locations outside it - the classic CWE-22 relative/absolute path traversal class. The CPE cpe:2.3:a:floci-io:floci:*:*:*:*:*:*:*:* is a wildcard entry covering all versions through the reported 2.4.0 ceiling, confirming no version-specific exclusion. Consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, the weakness yields file disclosure rather than code execution or data tampering; the available sources do not describe the exact route by which an attacker-supplied base-directory value reaches parseArtifacts, so whether a non-default configuration or a specifically exposed submission endpoint is required remains unverified.
Know when Floci gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Remotely reachable traversal with no authentication or interaction indicated (AV:N/AC:L/PR:N/UI:N); impact limited to partial file disclosure (C:L) with no integrity or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was determined in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJsonHandler.java of the component Artifact Handler. This manipulation of the argument buildspecOverride.artifacts.base-directory causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB