Affected versions of Flowintel permit the LOG_FILE configuration parameter to be set to any filesystem path by an administrator through the web interface. Because the application does not enforce relative‑path restrictions, an attacker controlling log content can write template payloads to arbitrary locations. When the application later renders the injected template, arbitrary code is executed. This flaw combines a directory traversal‑like vulnerability (CWE-22) with a template injection (CWE-94) and enables remote code execution and potentially full system compromise.

All Flowintel deployments running version 3.3.0 or later are affected, provided the LOG_FILE setting is exposed via the web configuration. The vulnerability arises because the LOG_FILE value is not validated against the intended log directory, allowing absolute paths, traversal, or platform‑specific segments.

The vulnerability has a CVSS score of 7.5, indicating high severity. No EPSS score is listed, but the flaw requires authenticated administrative access to modify LOG_FILE. Exploitation involves setting LOG_FILE to an arbitrary path, injecting a malicious template into the log file, and triggering the application's rendering process to execute code. The lack of reported public exploits and absence from the CISA KEV list suggests the exploit is not yet widely available, yet the attack vector remains remote and feasible for any administrator with write access.