Findings
Public vulnerability disclosures.
CVE-2026-77314
Path traversal in flyto-core’s MCP recipe runner
- Type
- Path traversal / CWE-22
- Affected
- flyto-core ≤ 2.26.7
- Severity
- Moderate · CVSS 6.3
- Disclosure
- 11 July 2026
- Status
- Fixed in 2.26.8
- Credit
- awwfensive — reporter
An MCP caller could traverse outside the bundled recipe directory and execute reachable YAML workflows, subject to the module policy.