A path traversal flaw has been disclosed in FlowCI, the open-source continuous integration tool, that lets a crafted ZIP archive write files outside the folder where job reports are extracted. The vulnerability, tracked as CVE-2026-124329, affects flow-core-x versions up to 1.23.49, and the exploit has been made public.

The flaw is a classic ZipSlip weakness, classified as CWE-22. FlowCI's FileHelper.unzip method extracts ZIP archives using Java's ZipInputStream and builds each output path by joining the destination folder with the entry name taken from the archive. That entry name is attacker-controlled metadata, and the code never sanitises it: there is no normalisation, no rejection of dot-dot-slash sequences, and no check that the resolved path stays inside the destination folder. A ZIP entry named with a sequence such as ../../../../cve03_browser_escape.txt is therefore written outside the extraction directory.

The trigger chain runs through FlowCI's job reports. An agent uploads a ZIP archive as a job report, and when an authenticated user requests that report, the server passes the archive to the unzip routine. The researcher who reported the flaw, Zy0t1, showed the issue in the report-extraction flow and noted that the affected code has been present since 2019 and was never patched. The disclosure states that the vendor was contacted early about the issue but did not respond.

The CVE record rates the flaw as medium severity under CVSS 3.1, with a vector showing a network attack of high complexity that needs a low-privileged authenticated account and no user interaction. The researcher, however, assessed it higher, at 7.6, on the grounds that a successful escape can overwrite files with high impact on integrity and availability. Either way, the practical risk is clear: a low-privileged user who can submit a job report can place files in locations the application never intended, which can lead to configuration changes, overwritten scripts or further compromise depending on what runs on the host.

The fix is to update FlowCI flow-core-x to version 1.23.50 or later. Until the update is applied, administrators should review who can upload job reports and audit report archives before they are extracted. A second, related FlowCI flaw was disclosed the same day, CVE-2026-124330, a path traversal issue in the LocalFileManager component, which underlines that the file-handling code in this product needs a thorough review rather than a single patch.

The CVE record for CVE-2026-124329 was published on 8 November 2026. No attacks in the wild have been reported, but the exploit is public, so FlowCI operators should not wait to update.