{"data":{"id":"66b5caa9-501e-4854-b3fa-3bb7f14c5574","title":"GHSA-2956-977x-2w3r: Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)","summary":"Flyto2 Core has a file-writing vulnerability in `image.download` and 12 other file-writing modules (like `image.convert`, `document.pdf_fill_form`, etc.) that allows attackers to write files anywhere on the system. The problem is that these modules check whether the target file is within a base directory, but the attacker controls both the target file path and the base directory parameter, making the check useless. For example, if an attacker sets `output_dir='/'`, any target path passes the validation, and the attacker's data (from a URL or format operation) gets written to any location the process can access.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-2956-977x-2w3r","publishedAt":"2026-07-30T14:46:43.000Z","cveId":"CVE-2026-67429","cweIds":null,"cvssScore":null,"cvssSeverity":"critical","severity":"critical","attackType":["supply_chain"],"issueType":"vulnerability","affectedPackages":["flyto-core@< 2.26.7 (fixed: 2.26.7)"],"affectedVendors":[],"affectedVendorsRaw":["Flyto2"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00494,"patchAvailable":true,"disclosureDate":"2026-07-30T14:46:43.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity","confidentiality","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0010"]}}