{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afloci-iofloci/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:floci-io:floci:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-124509"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Floci (\u003c= 2.1.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["floci-io"],"content_html":"\u003cp\u003efloci-io Floci versions up to 2.1.0 are vulnerable to a path traversal attack within the S3 Destination Configuration Handler. The issue exists in the function S3Destination.bucketName located in 'services/firehose/model/DeliveryStreamDescription.java'. Attackers can exploit this remotely by providing malicious input to the BucketARN argument. A patch is available in commit b986b95074ef524019be7af51e1df172e48faa4b, and the vendor has released version 2.2.0 to resolve the vulnerability. Public exploit code is available.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for path traversal, which may lead to unauthorized access to files or sensitive data within the environment hosting the Floci service.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all instances of floci-io Floci to version 2.2.0 or later immediately.\u003c/li\u003e\n\u003cli\u003eAudit logs for the S3 Destination Configuration Handler to identify anomalous inputs to the BucketARN parameter.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T03:24:02Z","date_published":"2026-11-09T03:24:02Z","id":"https://feed.craftedsignal.io/briefs/2026-11-floci-path-traversal/","summary":"A path traversal vulnerability in the S3Destination.bucketName function of floci-io Floci allows remote attackers to manipulate the BucketARN argument via the S3 Destination Configuration Handler.","title":"floci-io Floci: S3 Destination configuration path traversal (CVE-2026-124509)","url":"https://feed.craftedsignal.io/briefs/2026-11-floci-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:floci-Io:floci:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}