CVE-2026-67429

Deferred Deferred - Pending Action

Path Traversal in Flyto2 Core

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir instead of validate_path_with_env_config and its FLYTO_SANDBOX_DIR confinement, allowing attacker-controlled response bytes to be written to arbitrary filesystem paths the process can access. This issue is fixed in version 2.26.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67429

Affected Vendors & Products

Vendor	Product	Version / Range
flyto2	core	to 2.26.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

Flyto2 Core before version 2.26.6 has a vulnerability where image.download and other file-writing modules use a caller-controlled output_dir instead of the secure validate_path_with_env_config. This allows attackers to write arbitrary files to any filesystem path the process can access.

Detection Guidance

Check Flyto2 Core versions before 2.26.6 for improper path handling in image.download and related modules. Inspect file-writing operations for use of caller-controlled output_dir instead of validate_path_with_env_config. Monitor for unexpected file writes outside intended sandbox directories.

Impact Analysis

This vulnerability allows attackers to write malicious files to any accessible location on your system. This could lead to code execution, data theft, or system compromise depending on the attacker's goals and your system configuration.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, potentially violating data integrity and confidentiality requirements in GDPR and HIPAA. It may result in non-compliance due to insufficient file access controls.

Mitigation Strategies

Upgrade Flyto2 Core to version 2.26.6 or later to address the insecure file-writing vulnerability. Ensure all modules using image.download and related functions are updated to use validate_path_with_env_config with FLYTO_SANDBOX_DIR confinement.

Hi! I’m here to help you understand CVE-2026-67429. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70