PT-2026-65896

CVE-2026-67429

Published

2026-07-29

Updated

2026-08-04

Description by

CVSS 3.1

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6

Description The image.download and related file-writing modules use a caller-controlled output dir instead of the validate path with env config function and its FLYTO SANDBOX DIR confinement. This allows attacker-controlled response bytes to be written to arbitrary filesystem paths that the process can access.

Recommendations Update to version 2.26.6.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-73: External Control of File Name or Path

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2026-67429