CVE-2026-124509

A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulation of the argument BucketARN leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. The name of the patch is b986b95074ef524019be7af51e1df172e48faa4b. You should upgrade the affected component.

• CWE-22

• https://github.com/floci-io/floci/
• https://github.com/floci-io/floci/commit/b986b95074ef524019be7af51e1df172e48faa4b
• https://github.com/floci-io/floci/issues/4281
• https://github.com/floci-io/floci/pull/4289
• https://github.com/floci-io/floci/releases/tag/2.2.0
• https://vuldb.com/cve/CVE-2026-124509
• https://vuldb.com/submit/1035485
• https://vuldb.com/vuln/432813
• https://vuldb.com/vuln/432813/cti
• https://github.com/floci-io/floci/issues/4281

Published

Nov 9, 2026

Last Modified

Nov 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-124503A vulnerability was identified in sooperset mcp-atlassian up…4.3
• CVE-2026-124504A vulnerability was detected in erupts erupt up to 2.3.0. Af…6.3
• CVE-2026-124505A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. T…4.3
• CVE-2026-124506A vulnerability has been found in Dianping CAT 3.0.0/3.1.0/4…4.3
• CVE-2026-124507A vulnerability was found in conductor-oss conductor up to 3…5.3
• CVE-2026-124508A vulnerability was determined in floci-io Floci up to 2.4.0…5.3
• CVE-2026-12451Use after free in DigitalCredentials in Google Chrome prior …8.3
• CVE-2026-12452Use after free in Downloads in Google Chrome on Android prio…8.8
• CVE-2026-12453Insufficient validation of untrusted input in Input in Googl…4.2
• CVE-2026-124536JSON::XS versions before 4.05 for Perl allow memory exhausti…
• CVE-2026-124539JSON::XS versions before 4.05 for Perl leak the decoded key …
• CVE-2026-12454Race in Safe Browsing in Google Chrome on Mac prior to 149.0…8.3