What’s Vulnerable › Vulnerabilities

CVE-2026-81659: Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-27 · updated 2026-08-28
• Weakness: CWE-22

Description

Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export.

Affected products

• flowintel: through 3.3.0

References

• https://github.com/flowintel/flowintel/commit/16f618fa36a72c4c5ca3ff0abf7dd67455318ef1
• https://github.com/flowintel/flowintel/commit/2ba9700a5473223639575050bda607f498add7c6

Get alerted when CVE-2026-81659 or the next vulnerability affects your stack