{"vulnerability": "ghsa-2956-977x-2w3r", "sightings": [{"uuid": "cfc9f4ce-73a8-475c-bf52-89065b168ed0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-2956-977x-2w3r", "type": "seen", "source": "https://gist.github.com/alon710/3970c6098c97c0a550d8b2c18182c3ad", "content": "# CVE-2026-67429: CVE-2026-67429: Arbitrary File Write and Path Traversal in Flyto2 Core Modules\n\n> **CVSS Score:** 10.0\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-67429\n\n## Summary\nCVE-2026-67429 is a critical path traversal vulnerability in Flyto2 Core file-writing modules, including image.download and twelve other modules. By exploiting an insecure validation check that relied on user-controlled parameters, unauthenticated remote attackers can bypass directory confinement and write arbitrary files to the file system, leading to remote code execution.\n\n## TL;DR\nA critical path traversal vulnerability in Flyto2 Core allows unauthenticated remote code execution via arbitrary file write due to caller-controlled base directory validation parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-73\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 10.0 (Critical)\n- **EPSS Score**: 0.00494\n- **Impact**: Arbitrary File Write / Remote Code Execution\n- **Exploit Status**: Proof of Concept (PoC) verified\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Flyto2 Core\n- **flyto-core**: < 2.26.6 (Fixed in: `2.26.6`)\n\n## Mitigation\n\n- Upgrade Flyto2 Core to version 2.26.6\n- Define FLYTO_SANDBOX_DIR to restrict write permissions\n- Run Flyto2 Core in an unprivileged, read-only container\n\n**Remediation Steps:**\n1. Identify all active instances of Flyto2 Core in the environment.\n2. Apply the patch by upgrading the PyPI package to version 2.26.6.\n3. Configure the FLYTO_SANDBOX_DIR environment variable to enforce static boundaries.\n4. Audit application logs for suspicious directory overrides in image or document module parameters.\n\n## References\n\n- [GitHub Security Advisory GHSA-2956-977x-2w3r](https://github.com/flytohub/flyto-core/security/advisories/GHSA-2956-977x-2w3r)\n- [Fix Commit d5f89d71303e](https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc)\n- [Release Notes v2.26.6](https://github.com/flytohub/flyto-core/releases/tag/v2.26.6)\n- [CVE-2026-67429 Record](https://www.cve.org/CVERecord?id=CVE-2026-67429)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-67429) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T00:31:48.890056Z"}]}