Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-67429.
Unlock with Pro - from £29/user/moDetect Flyto2 Core Arbitrary File Write via image.download Path Traversal (CVE-2026-67429) in Splunk
Detects exploitation of CVE-2026-67429, a critical (CVSS 10.0) arbitrary file write vulnerability in Flyto2 Core (pip package flyto-core) versions prior to 2.26.7. The image.download module and other file-writing modules fail to sanitize user-supplied filenames/paths (CWE-22 path traversal, CWE-73 external control of file name or path), allowing an unauthenticated or low-privileged attacker to write arbitrary files anywhere on the filesystem reachable by the flyto-core process. This can be leveraged to overwrite application code, cron files, SSH authorized_keys, systemd unit files, or web-accessible directories to achieve remote code execution. Detection focuses on identifying path traversal sequences and absolute/unexpected path targets passed to flyto-core's image.download and related file-writing endpoints, as well as downstream evidence such as newly written files in sensitive directories immediately following flyto-core process activity.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
SPL Detection Query
index=* (sourcetype=linux_secure OR sourcetype=WinEventLog:Security OR sourcetype=*process* OR sourcetype=*file*)
(process_name="python*" OR process_name="python3*" OR process_name="gunicorn" OR process_name="uwsgi")
(CommandLine="*flyto*" OR CommandLine="*image.download*")
| eval traversal=if(match(CommandLine, "(\.\.\/){2,}|(\.\.\\\\){2,}|%2e%2e%2f|%2e%2e/"), 1, 0)
| where traversal=1
| table _time, host, user, process_name, CommandLine
| append [
search index=* sourcetype=*file* (file_path="*/etc/*" OR file_path="*/root/.ssh/*" OR file_path="*authorized_keys*" OR file_path="*cron.d*" OR file_path="*C:\\Windows*" OR file_path="*wwwroot*" OR file_path="*inetpub*") (parent_process_name="python*" OR parent_process_name="gunicorn" OR parent_process_name="uwsgi")
| table _time, host, user, parent_process_name, file_path
]
| sort - _timeSplunk search identifying path traversal sequences in flyto-core image.download command lines and subsequent writes to sensitive filesystem locations consistent with CVE-2026-67429 exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Automated vulnerability scanners intentionally testing the path traversal condition as part of authorized security testing
- CI/CD pipelines exercising the flyto-core image download API with unusual but legitimate relative paths
- File integrity monitoring noise from unrelated backup jobs writing to the same sensitive directories
Other platforms for CVE-2026-67429
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Path Traversal via image.download to /etc/
Expected signal: Process event for the python3 process with command line referencing flyto_core and a path containing multiple '../' sequences; file creation event for /etc/flyto_poc_test.txt.
- Test 2Arbitrary File Write to SSH authorized_keys
Expected signal: File modification event on /root/.ssh/authorized_keys initiated by the flyto-core python process shortly after a traversal-pattern process command line.
- Test 3Path Traversal via image.download on Windows
Expected signal: Process creation event for python.exe with command line containing flyto and backslash traversal sequences; file creation event under C:\Windows\Temp\.
References (5)
- https://github.com/flytohub/flyto-core/security/advisories/GHSA-2956-977x-2w3r
- https://nvd.nist.gov/vuln/detail/CVE-2026-67429
- https://github.com/flytohub/flyto-core/commit/d5f89d71303e3c1e6418d347c5c55fcd173cc8cc
- https://github.com/flytohub/flyto-core/releases/tag/v2.26.6
- https://github.com/advisories/GHSA-2956-977x-2w3r
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-67429 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month