A flaw in Floci's Artifact Handler allows an attacker to tamper with the buildspecOverride.artifacts.base-directory parameter, resulting in path traversal. The vulnerability is present in all releases up to 2.4.0 and can be triggered remotely by supplying a specially crafted buildspec file. If exploited, an attacker may read, write, or execute files outside the intended directory, potentially leading to disclosure of sensitive data or unauthorized code execution.

The issue affects the floci-io Floci application, versions 2.4.0 and earlier. The specific component impacted is CodeBuildJsonHandler.parseArtifacts within the Artifacts Handler. Current installations using Floci 2.4.0 or below are at risk. No vendor updates or patches have been released publicly.

The CVSS base score of 6.9 indicates a medium to high severity risk, while no EPSS score is available and the vulnerability is not listed in CISA's KEV product catalog. Because the attack can be performed remotely, threat actors can attempt the exploit over the network. The lack of an official fix means the risk remains until a vendor patch or community fix becomes available.