A critical path traversal vulnerability in flyto-core allows unauthenticated attackers to write arbitrary files to the host filesystem, potentially leading to full system compromise.

This vulnerability occurs because the image.download and related modules fail to utilize mandatory sandbox path validation. An unauthenticated attacker can manipulate the output directory parameter to bypass security constraints and write arbitrary data to restricted locations on the server.

Successful exploitation allows an attacker to overwrite critical system files or place malicious scripts, which can lead to complete server takeover, unauthorized data access, or persistent backdoors. Given the CVSS score of 10.0, this represents a critical risk to business operations, data integrity, and regulatory compliance.

Immediate Action: Update flyto-core to version 2.26.6 or later immediately.

Proactive Monitoring: Inspect filesystem integrity and monitor for unexpected file creation events in directories outside of defined application storage paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block malicious requests containing path traversal sequences or attempts to manipulate directory parameters.

Public Exploit Available: No (unknown)

This vulnerability presents a maximum-severity threat due to the lack of required authentication and the potential for total system compromise. Organizations running flyto-core must prioritize the update to version 2.26.6 to restore sandbox integrity and prevent unauthorized filesystem access.