floci-io Floci: S3 Destination configuration path traversal (CVE-2026-124509)
A path traversal vulnerability in the S3Destination.bucketName function of floci-io Floci allows remote attackers to manipulate the BucketARN argument via the S3 Destination Configuration Handler.
CVE search metadata
CVE search record: CVE-2026-124509. Severity: high. CVSS: 7.3. KEV: no. Product: Floci (<= 2.1.0). Brief: floci-io Floci: S3 Destination configuration path traversal (CVE-2026-124509). Brief link: https://feed.craftedsignal.io/briefs/2026-11-floci-path-traversal/
Triage facts
Revision 1- Applicability
- Floci (<= 2.1.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 9, 03:24 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
floci-io Floci versions up to 2.1.0 are vulnerable to a path traversal attack within the S3 Destination Configuration Handler. The issue exists in the function S3Destination.bucketName located in 'services/firehose/model/DeliveryStreamDescription.java'. Attackers can exploit this remotely by providing malicious input to the BucketARN argument. A patch is available in commit b986b95074ef524019be7af51e1df172e48faa4b, and the vendor has released version 2.2.0 to resolve the vulnerability. Public exploit code is available.
Impact
Successful exploitation allows for path traversal, which may lead to unauthorized access to files or sensitive data within the environment hosting the Floci service.
Recommendation
- Upgrade all instances of floci-io Floci to version 2.2.0 or later immediately.
- Audit logs for the S3 Destination Configuration Handler to identify anomalous inputs to the BucketARN parameter.
Immediate actions
Upgrade Floci to version 2.2.0
Threat Hunt
Identify abnormal path traversal characters (../) in S3 BucketARN configuration parameters
Data: Application logs for S3 Destination Configuration updates
Mitigations
Upgrade to version 2.2.0
CVE-2026-124509