CVE-2026-67429: CVE-2026-67429: Arbitrary File Write and Path Traversal in Flyto2 Core Modules

#security #cve #cybersecurity

CVE-2026-67429: Arbitrary File Write and Path Traversal in Flyto2 Core Modules

Vulnerability ID: CVE-2026-67429
CVSS Score: 10.0
Published: 2026-07-30

CVE-2026-67429 is a critical path traversal vulnerability in Flyto2 Core file-writing modules, including image.download and twelve other modules. By exploiting an insecure validation check that relied on user-controlled parameters, unauthenticated remote attackers can bypass directory confinement and write arbitrary files to the file system, leading to remote code execution.

TL;DR

A critical path traversal vulnerability in Flyto2 Core allows unauthenticated remote code execution via arbitrary file write due to caller-controlled base directory validation parameters.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22, CWE-73
Attack Vector: Network (AV:N)
CVSS Score: 10.0 (Critical)
EPSS Score: 0.00494
Impact: Arbitrary File Write / Remote Code Execution
Exploit Status: Proof of Concept (PoC) verified
KEV Status: Not listed

Affected Systems

Flyto2 Core
flyto-core: < 2.26.6 (Fixed in: 2.26.6)

Code Analysis

Commit: d5f89d7

centralize path validation with sandbox guard

Mitigation Strategies

Upgrade Flyto2 Core to version 2.26.6
Define FLYTO_SANDBOX_DIR to restrict write permissions
Run Flyto2 Core in an unprivileged, read-only container

Remediation Steps:

Identify all active instances of Flyto2 Core in the environment.
Apply the patch by upgrading the PyPI package to version 2.26.6.
Configure the FLYTO_SANDBOX_DIR environment variable to enforce static boundaries.
Audit application logs for suspicious directory overrides in image or document module parameters.

References

Read the full report for CVE-2026-67429 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community