CVE-2026-67429: Critical Arbitrary File Write in Flyto2 Core (flyto-core) via image.download Path Traversal

What's the vulnerability?

CVE-2026-67429 is a critical (CVSS 10.0) arbitrary file write vulnerability in Flyto2 Core, rooted in insufficient sanitization of user-supplied filenames and paths passed to the image.download module and other file-writing endpoints. The flaw maps to CWE-22 (path traversal) and CWE-73 (external control of file name or path).

Because the affected code does not validate or normalize incoming path input, an attacker can supply sequences like ../ or absolute paths to force the application to write files outside its intended storage directory. Given that the writing process typically runs with the privileges of the flyto-core service, this can be escalated to overwrite application code, cron files, SSH authorized_keys, systemd unit files, or web-accessible directories — any of which can lead to full remote code execution on the host.

Affected Software

• Vendor/Ecosystem: pip (PyPI)
• Package: flyto-core
• Affected versions: < 2.26.7
• Patched version: Not specified in vendor advisory data at time of publication

Exploitation Status

A public proof-of-concept (PoC) is available for this vulnerability, and it was disclosed on 2026-07-30. Public PoC availability significantly raises the near-term risk: defenders should treat this as actively exploitable and prioritize patching or mitigating exposed instances, since weaponization by opportunistic attackers typically follows shortly after PoC release. There is no indication of confirmed KEV listing or in-the-wild exploitation in the data provided.

How Our Detection Catches It

Our detection focuses on two complementary signal sources:

• Path traversal in request/parameter data: Identifying traversal sequences (e.g., ../, encoded variants) and absolute or unexpected path targets passed as filename/path parameters to flyto-core's image.download and related file-writing operations.
• Downstream file-write evidence: Correlating flyto-core process activity with newly created or modified files in sensitive locations — such as SSH key directories, cron paths, systemd unit directories, or web roots — occurring immediately afterward.

This logic ships across our full SIEM coverage matrix: Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL/Fusion). Each rule is tuned to its platform's native log sources and field schema so you can deploy without rebuilding logic from scratch.

Full Detection Details

For the complete detection logic, including platform-specific queries, MITRE ATT&CK mapping, and recommended response actions, see the CVE-2026-67429 detection page.