FlowCI vulnerabilities

Products

• flow-core-x 4

Latest FlowCI CVEs

Newest publication first

1. CVE-2026-124330 FlowCI flow-core-x LocalFileManager LocalFileManager.java remove path traversal

   Published 2026-11-08

   Low·CVSS 2.3 EPSS 0.31%

   A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the file store/src/main/java/com/flowci/store/LocalFileManager.java of the component LocalFileManager. This manipulation of the argument fileName causes path tr...

2. CVE-2026-124329 FlowCI flow-core-x FileHelper.java FileHelper.unzip path traversal

   Published 2026-11-08

   Low·CVSS 2.3 EPSS 0.31%

   A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the function FileHelper.unzip of the file common/src/main/java/com/flowci/common/helper/FileHelper.java. The manipulation results in path traversal. The attack may be performed from remote. A h...

3. CVE-2026-124328 FlowCI flow-core-x Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run code injection

   Published 2026-11-08

   Medium·CVSS 5.3 EPSS 0.38%

   A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/core/common/manager/ConditionManagerImpl.java of the component Groovy Script Evaluation. The manipulation of...

4. CVE-2026-4215 FlowCI flow-core-x SMTP Host ConfigServiceImpl.java save server-side request forgery

   Published 2026-03-16

   Medium·CVSS 5.3 EPSS 0.23%

   A security flaw has been discovered in FlowCI flow-core-x up to 1.23.01. The impacted element is the function Save of the file core/src/main/java/com/flowci/core/config/service/ConfigServiceImpl.java of the component SMTP Host Handler. The manipulation results in server-side requ...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.