CVE-2026-67429 Details
Description
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir instead of validate_path_with_env_config and its FLYTO_SANDBOX_DIR confinement, allowing attacker-controlled response bytes to be written to arbitrary filesystem paths the process can access. This issue is fixed in version 2.26.6.
A vulnerability in Flyto2 Core versions prior to 2.26.6 allows for arbitrary file writes via the image.download module. The issue arises because the module uses a caller-controlled output directory without proper validation, enabling attacker-controlled response bytes to be written to any accessible filesystem path. This vulnerability is part of a broader issue affecting several file-writing modules within the application.
Users are advised to upgrade to Flyto2 Core version 2.26.6, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/flytohub/flyto-core/security/advisories/GHSA-2956-977x-2w3r | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc | [email protected] | Source CodeVendor |
| https://github.com/flytohub/flyto-core/releases/tag/v2.26.6 | [email protected] | Release NotesVendor |
| https://github.com/flytohub/flyto-core/security/advisories/GHSA-2956-977x-2w3r | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flyto2 Core | < 2.26.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |