Arbitrary File Write Vulnerability in flyto‑core 2.26.7 Bypasses Sandbox Guard
What Happened – The open‑source flyto‑core library (versions ≤ 2.26.7) contains an unchecked path‑validation flaw in the data.csv_write and data.json_to_csv modules. An attacker can supply arbitrary file paths that escape the FLYTO_SANDBOX_DIR confinement, resulting in files being written anywhere on the host filesystem. The issue is tracked by GHSA‑p34x‑fmph‑9fjx and was partially fixed in 2.26.8.
Why It Matters for Compliance & Audit Readiness
- The flaw illustrates a classic control‑mapping gap: a missing “input validation” control in the application‑level security baseline that SOC 2 auditors expect to see documented and continuously monitored.
- Continuous evidence of remediation (e.g., patch deployment, code‑review attestations) can be captured in Verisq’s Control Mapping module, providing a defensible audit trail for the CC6.1 – System Operations and CC7.1 – Change Management criteria.
Who Is Affected – SaaS providers, internal development teams, and any organization that incorporates the flyto‑core library into web‑application stacks (primarily TECH_SAAS).
Recommended Actions –
- Upgrade to flyto‑core 2.26.8 or later immediately.
- Add a static‑code‑analysis rule that flags any call to
validate_path_with_env_config()without proper sandbox enforcement. - Map the “input validation” control to your SOC 2 audit framework and capture remediation evidence in a continuous‑compliance repository.
Technical Notes – The vulnerability is a local arbitrary file write (no network payload) triggered by calling csv_write or json_to_csv with an out‑of‑sandbox path. It bypasses the validate_path_with_env_config() guard, effectively breaking the intended sandbox isolation. No CVE was assigned; the advisory is GHSA‑p34x‑fmph‑9fjx. Source: https://www.exploit-db.com/exploits/52655