The vulnerability resides in the FileHelper.unzip function of FlowCI’s flow-core-x component and allows an attacker to supply crafted zip entries that resolve to directories outside the intended extraction path. This path traversal could result in creation or overwriting of files adjacent to or above the report extraction directory if the unzip is performed on untrusted archives. The escape of file paths is possible from a remote context, and though the attack requires a high level of effort, the exploit has been made publicly available and can be performed by skilled adversaries. The impact is limited to the ability to tamper with or read files that should otherwise be protected within the job report extraction area, potentially exposing sensitive data or allowing modification of application state.

The affected product is FlowCI:flow-core-x, specifically the flow-core-x component. All releases up to and including version 1.23.49 are affected. No other product variants or later releases are known to be impacted based on the current CVE entry.

The CVSS score of 2.3 indicates low severity for this vulnerability, and EPSS data is not available. The vulnerability is not listed in CISA’s KEV catalog. The assessment notes that the attack can be executed from remote, the complexity is high, and the overall exploitability is considered difficult. Consequently, while the risk to high‑consequence systems is modest, the existence of a publicly available exploit warrants remediation to avoid potential data compromise or unauthorized file manipulation.