[0day-rubbish] FME Flow 2026.2 Zip-Slip arbitrary file write to code execution as LocalSystem (8.8)
FME Flow 2026.2 has a Zip-Slip flaw that can write arbitrary files and execute code as LocalSystem.
Researchers disclosed a Zip-Slip path traversal (CWE-22) in Safe Software FME Flow 2026.2 build 26333. Archive extraction in StoreManager.extract() uses zip entry names without normalizing parent-directory sequences, allowing arbitrary file writes. The write can lead to code execution as LocalSystem and is scored 8.8. No CVE or observed exploitation is stated.
- Affects Safe Software FME Flow 2026.2 build 26333.
- Zip extraction uses entry names without blocking parent-directory paths.
- Arbitrary file write can lead to code execution as LocalSystem.
- Scored 8.8; the disclosure names no CVE.
Posted by disclosure via Fulldisclosure on Sep 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Safe Software FME Flow 2026.2 build 26333. Type: path-traversal write inside archive extraction (Zip-Slip) in COM.safe.web.upload.StoreManager.extract(), shipped in clients-webservicesutil-1.0.jar (CWE-22). The sink builds each destination path from ZipArchiveEntry.getName() verbatim; commons-compress 1.26.2 does not normalise "..", and the class's own canonical...
This source does not provide full text. Read it at seclists.org.