SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-67429

CRITICAL · CVSS 10 EPSS 0.49% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-29 · Last synced 2026-08-28

CyberRota Analysis

AI-Generated

Flyto2 Core versions prior to 2.26.6 are vulnerable due to improper validation in the image.download and related file-writing modules, allowing attackers to write files to arbitrary filesystem paths. This critical vulnerability can lead to unauthorized file access and potential system compromise. Organizations using affected versions should prioritize upgrading to 2.26.6 to mitigate the risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-67429
Severity
CRITICAL
CVSS
10
EPSS
0.49%

Original NVD Description

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, image.download and related file-writing modules use caller-controlled output_dir instead of validate_path_with_env_config and its FLYTO_SANDBOX_DIR confinement, allowing attacker-controlled response bytes to be written to arbitrary filesystem paths the process can access. This issue is fixed in version 2.26.6.