Flowintel EUVD-2026-67007

Exploitation requires an authenticated Flowintel session with administrator privileges, which grants access to the system settings panel where LOG_FILE was web-editable prior to the patch. The target instance must be running Flowintel version 3.3.0 or later. The attacker must identify an application code path that both logs attacker-controlled content and subsequently causes the Jinja2 template engine to render the redirected log file - a specific rendering trigger documented in the upstream commit. Default installations where LOG_FILE has never been modified are not directly exploitable without first changing the setting. Exploitation is concretely limited by: administrator-level authentication (PR:H per CVSS 4.0 vector), the multi-step chaining of path redirection and template injection (AC:H), and the requirement for a specific rendering condition to be met (AT:P). Unauthenticated users and non-administrator authenticated users cannot exploit this vulnerability.

The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:N, score 7.5) correctly reflects a high-impact but access-constrained vulnerability. PR:H is the dominant limiting factor: exploitation is gated behind administrator-level credentials, meaning an attacker must either compromise admin credentials or be an insider threat before the path traversal becomes relevant. AC:H and AT:P further indicate the attack chain is multi-step and depends on specific application rendering conditions. No EPSS score was provided in source data, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis. The technical impact if successfully exploited is severe - full RCE with OS-level code execution under the Flowintel process account - making this a high-value post-compromise escalation primitive. The realistic threat model is insider abuse or an attacker who obtained admin credentials through a prior compromise (credential stuffing, phishing, or a separate vulnerability). The 7.5 score is well-calibrated: the high impact metrics are real, but PR:H and AC:H substantially contain opportunistic exploitability.

An attacker with administrative access to Flowintel's web interface navigates to system settings and changes LOG_FILE to a filesystem path pointing to a Jinja2 template file writable by the Flowintel process - for example, overwriting an existing application template. The attacker then submits case data or another logged input field containing a Jinja2 payload (such as a reverse shell via subprocess) that the application writes to the redirected path. When the application subsequently serves a page that renders the tampered template, the injected code executes with the privileges of the Flowintel web process, yielding full server access.