EUVD-2026-67007
GHSA-jhj7-jmh6-rrgr
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Administrator web access required (PR:H), multi-step template injection chain (AC:H), full RCE impact on the application server with scope unchanged.
Primary rating from Vendor (CIRCL).
CVSS VectorVendor: CIRCL
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory.
Because the application constructs the log destination from this configurable value, an administrator could set LOG_FILE to an arbitrary filesystem path. Since attackers can influence logged content, this enables controlled data to be written into unintended files. The upstream commit specifically describes an exploitation chain in which an attacker injects a template into a chosen file and subsequently abuses application rendering behavior to execute code.
The patch removes LOG_FILE from the web-editable settings, introduces validate_log_file_name() to reject absolute paths, traversal, Windows paths, null bytes, and directory components, and centralizes log path construction through resolve_log_file_path().
Version impacted: >=3.3.0
AnalysisAI
Remote code execution via log path traversal in Flowintel 3.3.0 and later is achievable by an authenticated administrator who redirects the LOG_FILE configuration setting to an arbitrary filesystem path and injects server-side template syntax through attacker-controlled logged content. The upstream commit explicitly documents this multi-step exploitation chain - redirecting log output to a template file and triggering application rendering to execute injected code - making weaponization technically straightforward for any attacker holding admin credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Flowintel session with administrator privileges, which grants access to the system settings panel where LOG_FILE was web-editable prior to the patch. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:N, score 7.5) correctly reflects a high-impact but access-constrained vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with administrative access to Flowintel's web interface navigates to system settings and changes LOG_FILE to a filesystem path pointing to a Jinja2 template file writable by the Flowintel process - for example, overwriting an existing application template. The attacker then submits case data or another logged input field containing a Jinja2 payload (such as a reverse shell via subprocess) that the application writes to the redirected path. … |
| Remediation | Upstream fix is available (commit); a tagged patched release version is not independently confirmed from available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Flowintel deployments and versions (especially 3.3.0 and later), and review administrator account access controls, recent privilege assignments, and authentication logs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Persistent session hijacking is possible in Flowintel version 3.3.0 and later because the application fails to invalidat
Privilege escalation in Flowintel's administrative user-edit API allows an organization administrator to modify full adm
Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-pr
Broken object-level authorization across Flowintel task endpoints allows authenticated editor-level users to perform una
Flowintel's PDF export pipeline passes attacker-controlled note content to Pandoc with the raw_tex extension enabled, al
Stored XSS via Vue template injection in FlowIntel allows an authenticated low-privilege user to persist malicious Vue i
Log injection in Flowintel versions 3.3.0 and later allows unauthenticated remote attackers to forge arbitrary log lines
Server-side request forgery in FlowIntel up to version 3.3.0 allows a low-privileged authenticated user to coerce the ap
Insufficient authorization on the Flowintel /my_assignment/user API endpoint allows any authenticated API user to retrie
Stored cross-site scripting in Flowintel's MISP timeline renderer allows an authenticated low-privileged attacker to inj
Stored cross-site scripting in Flowintel's calendar view (versions >= 3.3.0) allows an authenticated user with case-crea
Stored cross-site scripting in Flowintel case notes allows an authenticated low-privileged user to inject malicious Java
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today