Threats affecting pkg:github/floci-io/Floci

CVE-2026-124509 is a path traversal vulnerability in floci-io Floci versions 2.0 and 2.1.0. It affects the S3Destination.bucketName function in the S3 Destination Configuration Handler component. This vulnerability allows remote attackers to manipulate the BucketARN argument to perform path traversal. A public exploit exists. Upgrading to version 2.2.0 resolves the issue.

CVE-2026-124508 is a path traversal vulnerability in floci-io Floci versions 2.0 through 2.4.0. It affects the BuildspecParser.parseArtifacts function in the Artifact Handler component, allowing remote attackers to manipulate the buildspecOverride.artifacts.base-directory argument to perform path traversal. The vulnerability has a medium severity with a CVSS 4.0 score of 6.9. Public exploit details have been disclosed, but no vendor response or patch is currently available.