Threats affecting pkg:maven/flowci/flow-core-x

CVE-2026-124330 is a path traversal vulnerability in FlowCI flow-core-x affecting versions 1.23.0 through 1.23.19. It involves manipulation of the fileName argument in the LocalFileManager component, allowing remote attackers to traverse directories. The attack requires a high degree of complexity and is considered difficult to exploit. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.

CVE-2026-124329 is a path traversal vulnerability in FlowCI flow-core-x affecting versions 1.23.0 through 1.23.19. It occurs in the FileHelper.unzip function, allowing an attacker to manipulate file paths during the unzip process. The attack can be performed remotely but requires high complexity and is difficult to exploit. Public exploit code exists, but no vendor response or patch has been provided.

CVE-2026-124328 is a code injection vulnerability in FlowCI flow-core-x versions 1.23.0 through 1.23.19. It affects the ConditionManagerImpl.run function in the Groovy Script Evaluation component. The vulnerability allows remote attackers to inject code by manipulating the 'condition' argument. Public exploit code has been disclosed, but the vendor has not responded or provided a fix. The CVSS 4.0 base score is 5.3, indicating a medium severity level.