CVE-2026-67429 Splunk · SPL

Detect Flyto2 Core Arbitrary File Write via image.download Path Traversal (CVE-2026-67429) in Splunk

Detects exploitation of CVE-2026-67429, a critical (CVSS 10.0) arbitrary file write vulnerability in Flyto2 Core (pip package flyto-core) versions prior to 2.26.7. The image.download module and other file-writing modules fail to sanitize user-supplied filenames/paths (CWE-22 path traversal, CWE-73 external control of file name or path), allowing an unauthenticated or low-privileged attacker to write arbitrary files anywhere on the filesystem reachable by the flyto-core process. This can be leveraged to overwrite application code, cron files, SSH authorized_keys, systemd unit files, or web-accessible directories to achieve remote code execution. Detection focuses on identifying path traversal sequences and absolute/unexpected path targets passed to flyto-core's image.download and related file-writing endpoints, as well as downstream evidence such as newly written files in sensitive directories immediately following flyto-core process activity.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

SPL Detection Query

Splunk (SPL)
spl 
index=* (sourcetype=linux_secure OR sourcetype=WinEventLog:Security OR sourcetype=*process* OR sourcetype=*file*)
(process_name="python*" OR process_name="python3*" OR process_name="gunicorn" OR process_name="uwsgi") 
(CommandLine="*flyto*" OR CommandLine="*image.download*")
| eval traversal=if(match(CommandLine, "(\.\.\/){2,}|(\.\.\\\\){2,}|%2e%2e%2f|%2e%2e/"), 1, 0)
| where traversal=1
| table _time, host, user, process_name, CommandLine
| append [
 search index=* sourcetype=*file* (file_path="*/etc/*" OR file_path="*/root/.ssh/*" OR file_path="*authorized_keys*" OR file_path="*cron.d*" OR file_path="*C:\\Windows*" OR file_path="*wwwroot*" OR file_path="*inetpub*") (parent_process_name="python*" OR parent_process_name="gunicorn" OR parent_process_name="uwsgi")
  | table _time, host, user, parent_process_name, file_path
]
| sort - _time
critical severity medium confidence

Splunk search identifying path traversal sequences in flyto-core image.download command lines and subsequent writes to sensitive filesystem locations consistent with CVE-2026-67429 exploitation.

Data Sources

Endpoint process telemetryFilesystem monitoringWeb server access logs

Required Sourcetypes

linux_secureWinEventLog:Securitysysmonosquery:filesystem

False Positives & Tuning

  • Automated vulnerability scanners intentionally testing the path traversal condition as part of authorized security testing
  • CI/CD pipelines exercising the flyto-core image download API with unusual but legitimate relative paths
  • File integrity monitoring noise from unrelated backup jobs writing to the same sensitive directories

Other platforms for CVE-2026-67429

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Path Traversal via image.download to /etc/

    Expected signal: Process event for the python3 process with command line referencing flyto_core and a path containing multiple '../' sequences; file creation event for /etc/flyto_poc_test.txt.

  2. Test 2Arbitrary File Write to SSH authorized_keys

    Expected signal: File modification event on /root/.ssh/authorized_keys initiated by the flyto-core python process shortly after a traversal-pattern process command line.

  3. Test 3Path Traversal via image.download on Windows

    Expected signal: Process creation event for python.exe with command line containing flyto and backslash traversal sequences; file creation event under C:\Windows\Temp\.

Last updated: 2026-08-01 Research depth: standard
References (5)

Response Playbook

Triage

  1. Identify all hosts running flyto-core and determine the installed version via `pip show flyto-core`; confirm whether the version is < 2.26.7 and therefore vulnerable.
  2. Review process and file creation telemetry for the affected host(s) to identify command lines invoking image.download or other flyto-core file-writing modules with path traversal sequences (../, %2e%2e%2f, ..\\).
  3. Correlate any flagged traversal attempts with subsequent unexpected file writes outside the intended upload/media directory, especially in /etc/, ~/.ssh/authorized_keys, cron directories, or web-accessible roots.
  4. Check application/API logs and reverse proxy access logs for requests to flyto-core endpoints containing suspicious path parameters or unusually large/unexpected payloads around the same timeframe.
  5. Determine whether the flyto-core service is internet-facing or reachable only internally, and identify the source IP/account associated with the suspicious request to establish attacker context.

Containment

  1. Immediately upgrade flyto-core to version 2.26.7 or later, or if upgrade is not immediately possible, restrict/disable the image.download and other file-writing modules via configuration or a WAF rule blocking traversal sequences in relevant parameters.
  2. Isolate the affected host from the network (or restrict inbound access to the flyto-core service) if evidence of successful arbitrary file write or resulting code execution is found, pending full investigation.
  3. Revoke or rotate any credentials, SSH keys, or API tokens that may have been exposed or planted (e.g., if authorized_keys was modified) as a result of the file write.

Evidence Collection

  1. Preserve process creation, file creation/modification, and network connection logs for the affected host(s) covering at least 24 hours before and after the identified traversal event.
  2. Collect a forensic copy of any files written or modified via the vulnerability (e.g., altered authorized_keys, cron jobs, web shells) along with their timestamps, hashes, and ownership metadata before remediation.
  3. Capture the full flyto-core application logs and any reverse proxy/WAF logs showing the raw request that triggered the path traversal, including headers and payload.

Escalation Criteria

  • !Escalate to incident response if a written file resulted in code execution (e.g., a web shell dropped in a web root, a modified cron job, or an added SSH authorized_keys entry) or if lateral movement indicators are observed following the file write.
  • !Escalate if the affected flyto-core instance is internet-facing and processes untrusted/unauthenticated input, given the CVSS 10.0 rating and public PoC availability, as this constitutes an active, high-likelihood exploitation risk requiring executive/security leadership notification.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Flyto-core application/access logs showing the raw request path/parameters used with image.download or other file-writing modules
  • >Filesystem metadata (creation/modification timestamps, owner, permissions) of files written outside the expected upload directory
  • >Process execution logs showing the flyto-core worker process command line and any child processes spawned after the suspicious write

Tuning Guidance

Baseline expected flyto-core upload/download destination directories for your environment and suppress alerts where the resolved file path remains within that sanctioned directory tree. Exclude known vulnerability-scanning source IPs/service accounts used for authorized security testing. If flyto-core is deployed in a containerized environment where the process command line is wrapped by an orchestrator (e.g., Docker entrypoint scripts), adjust process-name matching to include the wrapping interpreter and confirm command_line still contains the raw flyto-core invocation. Increase confidence to high when a traversal-pattern process event is directly followed (within 1-2 minutes) by a file write to a sensitive directory on the same host.

Hunting Queries

Broad hunt for any flyto-core process invocation containing path traversal sequences, independent of destination path, to surface exploitation attempts that may not target the specific sensitive paths enumerated in the primary detection.

Hunting — KQL
kql 
DeviceProcessEvents
| where ProcessCommandLine has "flyto" and ProcessCommandLine matches regex @"\.\.[\\/]"
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine
Hunting — SPL
spl 
index=* CommandLine="*flyto*" CommandLine="*..*" | regex CommandLine="(\.\.[\\/]){2,}" | table _time host user CommandLine

Atomic Red Team Tests

Test 1 Path Traversal via image.download to /etc/
linux

Simulates an attacker invoking flyto-core's image.download module with a crafted path traversal filename to write a file into /etc/, validating detection of traversal sequences in process/API telemetry.

Command

bash 
python3 -c "import flyto_core; flyto_core.image.download(url='http://127.0.0.1:8080/test.png', filename='../../../../etc/flyto_poc_test.txt')"

Cleanup

bash 
rm -f /etc/flyto_poc_test.txt

Expected Telemetry

Process event for the python3 process with command line referencing flyto_core and a path containing multiple '../' sequences; file creation event for /etc/flyto_poc_test.txt.

Expected Detection

KQL/SPL/EQL rules matching traversal sequences in flyto-related command lines correlated with a file write to /etc/ should fire.

Test 2 Arbitrary File Write to SSH authorized_keys
linux

Simulates exploitation of the vulnerability to overwrite a user's SSH authorized_keys file via a crafted image.download filename, representing a high-impact persistence scenario.

Command

bash 
python3 -c "import flyto_core; flyto_core.image.download(url='http://127.0.0.1:8080/test.png', filename='../../../../root/.ssh/authorized_keys')"

Cleanup

bash 
restore /root/.ssh/authorized_keys from backup if overwritten in a lab snapshot; do not run against production hosts.

Expected Telemetry

File modification event on /root/.ssh/authorized_keys initiated by the flyto-core python process shortly after a traversal-pattern process command line.

Expected Detection

Sequence-based rules (Elastic EQL, KQL, CrowdStrike CQL) correlating traversal command line with authorized_keys file write should trigger a critical alert.

Test 3 Path Traversal via image.download on Windows
windows

Simulates arbitrary file write to a Windows system directory using flyto-core's image.download module with backslash traversal sequences, validating cross-platform detection coverage.

Command

powershell 
python -c "import flyto_core; flyto_core.image.download(url='http://127.0.0.1:8080/test.png', filename='..\\..\\..\\..\\Windows\\Temp\\flyto_poc_test.txt')"

Cleanup

powershell 
del C:\Windows\Temp\flyto_poc_test.txt

Expected Telemetry

Process creation event for python.exe with command line containing flyto and backslash traversal sequences; file creation event under C:\Windows\Temp\.

Expected Detection

KQL detection matching Windows path traversal patterns in flyto-core process command lines combined with a file write under C:\Windows\ should fire an alert.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1083File and Directory DiscoveryT1505.003Web Shell

Same Tactic: Initial Access

Popular Detections