Floci (<= 2.1.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/floci--2.1.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 03:24:02 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgfloci-io Floci: S3 Destination configuration path traversal (CVE-2026-124509)https://feed.craftedsignal.io/briefs/2026-11-floci-path-traversal/Mon, 09 Nov 2026 03:24:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-floci-path-traversal/A path traversal vulnerability in the S3Destination.bucketName function of floci-io Floci allows remote attackers to manipulate the BucketARN argument via the S3 Destination Configuration Handler.floci-io Floci versions up to 2.1.0 are vulnerable to a path traversal attack within the S3 Destination Configuration Handler. The issue exists in the function S3Destination.bucketName located in 'services/firehose/model/DeliveryStreamDescription.java'. Attackers can exploit this remotely by providing malicious input to the BucketARN argument. A patch is available in commit b986b95074ef524019be7af51e1df172e48faa4b, and the vendor has released version 2.2.0 to resolve the vulnerability. Public exploit code is available.

Impact

Successful exploitation allows for path traversal, which may lead to unauthorized access to files or sensitive data within the environment hosting the Floci service.

Recommendation

  • Upgrade all instances of floci-io Floci to version 2.2.0 or later immediately.
  • Audit logs for the S3 Destination Configuration Handler to identify anomalous inputs to the BucketARN parameter.
]]>highadvisory