{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Fme Flow",
          "vendor": "Safe",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Safe\nSoftware FME Flow 2026.2 build 26333.\n\nType: path-traversal write inside archive extraction (Zip-Slip) in\nCOM.safe.web.upload.StoreManager.extract(), shipped in\nclients-webservicesutil-1.0.jar (CWE-22). The sink builds each destination path\nfrom ZipArchiveEntry.getName() verbatim; commons-compress 1.26.2 does not\nnormalise \"..\", and the class\u0027s own canonical containment check isPathValid() is\ncalled only from the constructor, never from the extraction path.\n\nScoring. This finding is dual-scored, and the conditional figure is a\nnon-default configuration that is published alongside the primary, not instead\nof it:\n- PRIMARY, 8.8 High, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This is the\n  post-authentication rating: any authenticated user, including the\n  low-privilege fmeuser and fmeguest roles, can drive it. The upload branch that\n  sets opt_extractarchive=true performs no role or isPermitted check.\n- CONDITIONAL, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This\n  applies only where a public app is published with requireAuthentication=false\n  and allowTemporaryUploads=true, which is NOT a shipped default. The 9.8 figure\n  is conditional and is not the headline.\n\nImpact: arbitrary file write anywhere the Tomcat process can write, outside the\nupload sandbox (create-only; an existing destination file is neither truncated\nnor overwritten). On a default single-machine Windows install the repository root\nand WEBAPPSDIR share one ancestor volume, so the write reaches an expanded web\napplication\u0027s document root; with unpackWARs=true, no /* servlet mapping in\nfmeserver.war, and Tomcat installed as the FMEFlowAppServer service running as\n.\\LocalSystem, requesting the dropped .jsp yields command execution as\nLocalSystem. This is a low-privilege-to-LocalSystem escalation.\n\nAuthentication: authenticated (any valid token; no role check on the archive\nextraction branch).\n\nVerification boundary, stated plainly. We verified the vulnerable code itself,\nnot a deployed installation. A harness compiled against the exact jars that ship\nwith FME Flow 2026.2 called the real StoreManager.extract on a Linux lab host\nagainst Tomcat 10.1.42 on loopback; a zip entry name carrying enough \"../\"\nwrote a .jsp outside the sandbox and the container then compiled and executed\nit (marker recorded uid=0 on the Linux host). A complete Windows FME Flow\ninstallation was NOT deployed (it requires PostgreSQL plus a product licence), so\nthe end-to-end HTTP delivery chain rests on the decompiled source rather than on\na live run against the product. On Windows the Tomcat service identity is\n.\\LocalSystem, established from installer artefacts (configureTomcat.bat and the\nMSI property FMEFLOWUSER=LocalSystem) rather than observed; the expected\nproduction marker is whoami = nt authority\\system.\n\nThis is distinct from the previously published HTTP path-traversal fixes in this\nproduct, whose \"..\" sequences travel in the request URL and are collapsed by the\ncontainer\u0027s normalisation. Here the traversal travels inside zip entry names in\nthe request body, which URL normalisation never inspects, so those fixes do not\ncover this vector.\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/fme-flow-zipslip-arbitrary-file-write-rce\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nThe vendor has been notified through its published security contact. No vulnerability identifier has been assigned to\nthis finding yet.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/72"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/72"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/fme-flow-zipslip-arbitrary-file-write-rce"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/72"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] FME Flow 2026.2 Zip-Slip arbitrary file write to code execution as LocalSystem (8.8)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0425",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/72",
            "automated": true,
            "contentSha256": "23651f5ffa5d040159cb766682384ddd2f9c01320025ebb98c968b5e813f4900",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/72",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T04:53:59Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0425"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}