floci-io Floci Path Traversal Vulnerabilities

Path traversal in floci-io Floci 2.0 and 2.1.0 lets a caller supply a crafted bucket name through a Firehose S3 destination BucketARN and have the resulting object path resolved outside the owning account's storage directory whenever the persistent or hybrid storage backend is in use, exposing or overwriting another bucket's object version and annotation data. The flaw is fixed in 2.2.0 (commit b986b95074ef524019be7af51e1df172e48faa4b); the upstream advisory states that exploit code is publicly available and the CVSS 4.0 vector carries E:P, matching that maturity signal, and the issue is not listed in CISA KEV. Vendor severity is 6.9, while our own assessment of the mechanism is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - the PR:N rating in the published vector is not confirmed, since the escape is described relative to the owning account's directory and therefore implies an existing account context, and impact is bounded to crossing that per-account storage boundary rather than reaching arbitrary host files.

Path traversal in the Floci CodeBuild emulator (floci-io Floci through 2.4.0) allows remote attackers to read files outside the intended artifact directory by supplying a crafted buildspecOverride.artifacts.base-directory value that is processed by BuildspecParser.parseArtifacts in CodeBuildJsonHandler.java. The assessed impact is confidentiality-only (C:L, with no integrity or availability effect), and the assessed vector indicates no authentication or user interaction is required, so any reachable path that accepts an externally supplied buildspec artifacts configuration is in scope. The CVE record states that exploit details have been publicly disclosed and may be used; that reference is not verified as working exploit code, CISA KEV does not list this issue, and the vendor reportedly did not respond to the report, so no fixed release version is identified.