A path traversal flaw was identified in the S3Destination.bucketName function of floci-io Floci (up to version 2.1.0). By manipulating the BucketARN parameter, an attacker can cause the application to resolve file paths outside the intended S3 bucket, potentially allowing unauthorized read or write operations. The vulnerability is exploitable over the network and the exploit code is publicly available, meaning a remote attacker could leverage it without local access.

Systems running floci-io Floci before version 2.2.0, specifically release 2.1.0 or earlier, are affected. The flaw resides in the Firehose S3 Destination Configuration Handler component of the project. Users who integrate the S3Destination functionality should verify their deployed version and upgrade if required.

The CVSS score of 6.9 indicates moderate risk. Although the EPSS score is not available, the public exploit and remote attack vector elevate the concern. The vulnerability is not listed in the CISA KEV catalog, but path traversal is a well‑known issue that can jeopardize confidentiality or integrity if the application writes or reads files beyond the intended bucket.