CVE-2026-67429Escritura de archivos arbitrarios en Flyto2 Core
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir instead of validate_path_with_env_config and its FLYTO_SANDBOX_DIR confinement, allowing attacker-controlled response bytes to be written to arbitrary filesystem paths the process can access. This issue is fixed in version 2.26.6.
Ver en NVDAnálisis
Flyto2 Core permite la escritura de archivos arbitrarios en el sistema al omitir las restricciones del sandbox en sus módulos de descarga y automatización. Un atacante puede controlar la ruta de salida para sobrescribir archivos críticos del servidor o inyectar código malicioso en cualquier ubicación accesible por el proceso.
Roles relevantes
Severidad
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:HCWE-22CWE-73EPSS
Sin puntaje EPSS aún (CVE muy reciente).
Descripción técnica
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir instead of validate_path_with_env_config and its FLYTO_SANDBOX_DIR confinement, allowing attacker-controlled response bytes to be written to arbitrary filesystem paths the process can access. This issue is fixed in version 2.26.6.
Referencias
- https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc
- https://github.com/flytohub/flyto-core/releases/tag/v2.26.6
- https://github.com/flytohub/flyto-core/security/advisories/GHSA-2956-977x-2w3r
- https://github.com/flytohub/flyto-core/security/advisories/GHSA-2956-977x-2w3r