Floci-io vulnerabilities
We track 2 vulnerabilities in Floci-io products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 9, 2026.
2vulnerabilities
1critical
1high
0exploited
8.6average CVSS score
Latest Floci-io vulnerabilities
- 7.3 High severity
Floci: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulat
- 9.8 Critical severity
floci: Improper Control of Generation of Code
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template