{"metadata": {"vulnerability": "CVE-2026-124508", "count": 14, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2026-11-08T00:00:00Z", "date_only": false, "value": "2026-11-08T00:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / VulDB", "record": "CVE-2026-124508", "field": "containers.cna.timeline.0.time", "text": "Advisory disclosed"}, {"timestamp": "2026-11-08T01:00:00Z", "date_only": false, "value": "2026-11-08T01:00:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / VulDB", "record": "CVE-2026-124508", "field": "containers.cna.timeline.1.time", "text": "VulDB entry created"}, {"timestamp": "2026-11-08T10:53:42.109Z", "date_only": false, "value": "2026-11-08T10:53:42.109Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-124508", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-08T11:58:46Z", "date_only": false, "value": "2026-11-08T11:58:46.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / VulDB", "record": "CVE-2026-124508", "field": "containers.cna.timeline.2.time", "text": "VulDB entry last update"}, {"timestamp": "2026-11-09T01:15:23.149Z", "date_only": false, "value": "2026-11-09T01:15:23.149Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124508", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-09T01:15:23.149Z", "date_only": false, "value": "2026-11-09T01:15:23.149Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-124508", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-09T01:15:23.149Z", "date_only": false, "value": "2026-11-09T01:15:23.149Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulDB", "record": "CVE-2026-124508", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-09T01:21:38.590Z", "date_only": false, "value": "2026-11-09T01:21:38.590141Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117583858763218013", "record": "CVE-2026-124508", "field": "creation_timestamp", "uuid": "5cf4e31f-488b-4b91-83f9-b919096757cd", "content": "CVE-2026-124508 floci-io Floci Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts path traversal A vulnerability was determined in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJsonHandler.java of the component Artifact Handler. This manipulation of the argument buildspecOverride.artifacts.base-directory causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.\nhttps://www.cve.org/CVERecord?id=CVE-2026-124508https://vuldb.com/vuln/432812https://vuldb.com/vuln/432812/ctihttps://vuldb.com/cve/CVE-2026-124508https://vuldb.com/submit/1035484https://github.com/Floci-io/Floci/security/advisories/GHSA-4hjc-ww34-35c4https://github.com/Floci-io/Floci/#floci-io #Floci#CVE_2026_124508#bot", "url": "https://infosec.exchange/users/cve/statuses/117583858763218013"}, {"timestamp": "2026-11-09T02:16:58Z", "date_only": false, "value": "2026-11-09T02:16:58Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9V55-G5PJ-XWF7", "record": "GHSA-9V55-G5PJ-XWF7", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-09T02:16:58.987Z", "date_only": false, "value": "2026-11-09T02:16:58.987", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124508", "record": "FKIE_CVE-2026-124508", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T02:16:59.180Z", "date_only": false, "value": "2026-11-09T02:16:59.180", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124508", "record": "FKIE_CVE-2026-124508", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-09T03:32:08Z", "date_only": false, "value": "2026-11-09T03:32:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9V55-G5PJ-XWF7", "record": "GHSA-9V55-G5PJ-XWF7", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-09T03:32:08Z", "date_only": false, "value": "2026-11-09T03:32:08Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9V55-G5PJ-XWF7", "record": "GHSA-9V55-G5PJ-XWF7", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-09T03:35:44.896Z", "date_only": false, "value": "2026-11-09T03:35:44.896252Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/i6bur7qocpqkz", "record": "CVE-2026-124508", "field": "creation_timestamp", "uuid": "20351548-d122-47ee-9242-52ef00b36e89", "content": "CVE-2026-124508 - floci-io Floci Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts path traversal\nCVE ID : CVE-2026-124508\n \n Published : Nov. 9, 2026, 2:16 a.m. | 1\u00a0hour, 4\u00a0minutes ago\n \n Description : A vulnerability was determined in floci-io Floci up to 2.4...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/i6bur7qocpqkz"}], "metrics": {"as_of": "2026-11-10T12:36:29.033Z", "anchors": {"origin": {"timestamp": "2026-11-09T01:15:23.149Z", "date_only": false, "value": "2026-11-09T01:15:23.149Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124508", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-09T01:15:23.149Z", "date_only": false, "value": "2026-11-09T01:15:23.149Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124508", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 127265.884856, "hours": 35.351634682222226, "days": 1.472984778425926, "min_seconds": 127265.884856, "max_seconds": 127265.884856, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-09T01:15:23.149Z", "date_only": false, "value": "2026-11-09T01:15:23.149Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124508", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-10T12:36:29.033Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}