[0day-rubbish] FME Flow 2026.2 Zip-Slip arbitrary file write to code execution as LocalSystem (8.8)
FME Flow 2026.2 has a Zip-Slip flaw that can write arbitrary files and execute code as LocalSystem.
Researchers disclosed a Zip-Slip path traversal (CWE-22) in Safe Software FME Flow 2026.2 build 26333. Archive extraction in StoreManager.extract() uses zip entry names without normalizing parent-directory sequences, allowing arbitrary file writes. The write can lead to code execution as LocalSystem and is scored 8.8. No CVE or observed exploitation is stated.
- Affects Safe Software FME Flow 2026.2 build 26333.
- Zip extraction uses entry names without blocking parent-directory paths.
- Arbitrary file write can lead to code execution as LocalSystem.
- Scored 8.8; the disclosure names no CVE.
- Vendors
- Safe Software
- Products
- FME Flow
- Organizations
- 0day Rubbish Research TeamSafe Software
From the original article
Posted by disclosure via Fulldisclosure on Sep 26 0day Rubbish Research Team is publicly disclosing a vulnerability in Safe Software FME Flow 2026. 2 build 26333. Type: path-traversal write inside archive extraction (Zip-Slip) in COM.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.