CVE-2026-81743

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81743
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81743.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81743
Published
2026-08-27T11:59:50.189Z
Modified
2026-08-30T03:30:42.777045132Z
Severity
  • 7.5 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Flowintel Arbitrary Log File Path Allows Remote Code Execution via Template Injection
Details

Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the intended log directory.

Because the application constructs the log destination from this configurable value, an administrator could set LOG_FILE to an arbitrary filesystem path. Since attackers can influence logged content, this enables controlled data to be written into unintended files. The upstream commit specifically describes an exploitation chain in which an attacker injects a template into a chosen file and subsequently abuses application rendering behavior to execute code.

The patch removes LOGFILE from the web-editable settings, introduces validatelogfilename() to reject absolute paths, traversal, Windows paths, null bytes, and directory components, and centralizes log path construction through resolvelogfile_path().

Version impacted: >=3.3.0

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81743.json",
    "cwe_ids": [
        "CWE-22",
        "CWE-94"
    ],
    "cna_assigner": "CIRCL"
}
References

Affected packages

Git / github.com/flowintel/flowintel

Affected ranges

Type
GIT
Repo
https://github.com/flowintel/flowintel
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
13785ee5d70a54d0ac97ba89dd31a478a86fc161
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.3.0"
        }
    ]
}

Affected versions

0.*
0.0.1
0.1.0
0.2.0
0.2.1
0.3.0
0.4.0
0.5.0
0.5.1
0.6.0
0.7.0
0.8.0
1.*
1.0.0
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.5.0
1.6.0
1.6.1
1.6.2
2.*
2.0.0
2.1.0
2.1.1
2.2.1
2.3.0
3.*
3.0.0
3.1.0
3.2.0
3.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81743.json"