CVE-2026-67429
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A vulnerability in Flyto2 Core before version 2.26.6 allows an attacker to write files to arbitrary filesystem paths by controlling the output_dir parameter in the image.download module. The lack of path validation against the FLYTO_SANDBOX_DIR configuration enables writing response bytes anywhere.
Risk Assessment
An attacker can overwrite critical system files or place malicious code in any directory, leading to privilege escalation or full system compromise.
Recommendation
Immediately upgrade Flyto2 Core to version 2.26.6 or later.
Original NVD description (English source)
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir instead of validate_path_with_env_config and its FLYTO_SANDBOX_DIR confinement, allowing attacker-controlled response bytes to be written to arbitrary filesystem paths the process can access. This issue is fixed in version 2.26.6.