Floci vulnerabilities

2 known vulnerabilities in Floci from Floci-io. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.3 High severity

  Floci: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-124509Nov 9, 2026Floci-io

  A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulat

• 9.8 Critical severity

  floci: Improper Control of Generation of Code

  CVE-2026-108598Oct 10, 2026Floci-io

  Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template