CVE-2026-81659

Executive Summary

CVE-2026-81659 is an unpatched vulnerability in Flowintel, a network intelligence platform, that enables an authenticated or unauthenticated attacker to read arbitrary local files from the Flowintel server through crafted note content processed during PDF export. The flaw leverages unsafe processing of attacker-controlled content by Pandoc and XeLaTeX during the export workflow, allowing local files to be read and embedded into the generated PDF document. No patch is currently available; affected organizations should treat all Flowintel deployments as vulnerable and apply immediate mitigation controls.

Technical Analysis

The vulnerability exists in the PDF export functionality of Flowintel, which relies on Pandoc and XeLaTeX as the underlying document conversion and typesetting engines. The NVD description indicates that "attacker-controlled note content" is processed by these tools "during PDF export" in an unsafe manner, resulting in the ability to "cause local files on the Flowintel server to be read and incorporated into the generated export."

The vulnerability class is path traversal (CWE-22). The attack mechanism follows this chain:

1. Input Vector: An attacker provides or modifies note content within the Flowintel application. The note content reaches the PDF export pipeline without adequate sanitization or validation.

2. Processing Chain: The note content is passed to Pandoc, the universal document converter, which converts the markdown/structured note format into an intermediate representation. This intermediate output is then processed by XeLaTeX, a TeX typesetting engine, to produce the final PDF document.

3. File Read Primitive: The unsafe processing likely exploits document markup capabilities within Pandoc or XeLaTeX that support file inclusion or resource referencing. For example, LaTeX's \input or \include commands, or Pandoc's handling of relative paths in embedded resources, can reference arbitrary file paths on the server's filesystem. If the note content is not sanitized for such directives, an attacker can inject a reference to a sensitive local file (e.g., /etc/passwd, configuration files, SSH keys, or other note content from other users).

4. Exfiltration: The referenced file's content is read by the Pandoc/XeLaTeX process and embedded into the generated PDF output. The attacker then retrieves the PDF export, extracting the file contents from the rendered document.

Specific technical details regarding the exact markup syntax or file-path encoding that triggers the vulnerability are not available from the NVD description. Insufficient technical detail is available to confirm whether authentication is required, which API endpoints are affected, or the precise Pandoc/XeLaTeX version combinations that are vulnerable. The severity of the flaw is compounded by the fact that the read operation executes with the privileges of the Flowintel service account, which could be a high-privilege context depending on deployment configuration.

The CWE-22 classification aligns with the path traversal nature of the file read, though the vulnerability manifests through the document processing pipeline rather than direct filesystem API access.

Exploitation Scenarios

Scenario 1: Authenticated User Exfiltrating Server Files

1. Reconnaissance/Target Identification: An attacker identifies a Flowintel instance exposed on the network. The attacker gains access to the application either through legitimate credentials (e.g., a compromised user account) or by registering an account if self-registration is enabled.

2. Triggering the Flaw: The attacker creates or edits a note within Flowintel that contains note content referencing a sensitive local file path. The exact syntax depends on the Pandoc/XeLaTeX processing chain—typical patterns for such vulnerabilities include embedding LaTeX file-inclusion commands (e.g., commands that read external files) or relative path references (e.g., ../../../../etc/passwd) within document markup that Pandoc passes through to the LaTeX engine.

3. Payload/Execution Method: The attacker initiates a PDF export of the note. The note content flows through the Pandoc-to-XeLaTeX pipeline, where file-inclusion directives resolve to arbitrary server-side paths. The target file is read by the processing engine during PDF generation.

4. Post-Exploitation Impact: The attacker downloads the generated PDF and extracts the contents of the targeted file. With server configuration files, credentials, or application secrets exposed, the attacker can escalate privileges, pivot to other systems, or gain persistent access to the infrastructure.

Scenario 2: External Attacker Targeting Exposed Deployment

1. Reconnaissance: Using Shodan queries such as http.title:'Flowintel' or http.html:'flowintel', an attacker identifies internet-exposed Flowintel instances.

2. Triggering: If any note creation or PDF export functionality is accessible without authentication (e.g., guest access, public note sharing features), the attacker crafts malicious note content directly without needing valid credentials.

3. Payload: The attacker submits the crafted note and triggers the export. The same Pandoc/XeLaTeX processing flaw is exploited server-side.

4. Post-Exploitation: The attacker exfiltrates sensitive files from the server filesystem. This could include the Flowintel database configuration, network topology data, or other intelligence artifacts stored on the platform.

Assessment: No public PoC is available for this CVE at the time of writing; the attack chain described above is inferred from the vulnerability class (CWE-22) and the NVD description of the processing chain. No exploit code or Nuclei template has been observed in the wild.

Impact Assessment

Business Impact: Flowintel is positioned as a network intelligence platform, meaning the data it hosts likely includes sensitive network reconnaissance results, asset inventories, and threat intelligence artifacts. A file-read vulnerability that allows an attacker to read arbitrary server files would critically compromise:

• Confidentiality: Complete compromise of server-side files, including credentials, configuration files, application secrets, and potentially data belonging to other platform users (e.g., other analysts' notes).
• Integrity: While the primary impact is information disclosure, the attacker's ability to read configuration files may reveal hardcoded credentials or API keys that enable subsequent unauthorized modifications of the platform's data.
• Availability: Not directly impacted by this vulnerability, though information gained could enable denial-of-service attacks against the platform or its underlying infrastructure.

Affected Systems: All deployments of Flowintel that use the PDF export functionality with Pandoc and XeLaTeX are affected. This includes on-premises installations as well as any managed service deployments offering this feature.

Blast Radius: The severity of this vulnerability is amplified by the privileged context in which the file read occurs. The Pandoc/XeLaTeX process inherits the operating system user context of the Flowintel service. If the service runs under a low-privileged account, the attacker gains access to application files and user data; if run under elevated privileges (as is common in Docker containers or misconfigured deployments), the read scope expands to the entire filesystem, including system files and, in some cases, mounted secrets or volumes accessible to the container.

CVSS Assessment: No CVSS score has been assigned by the CNA at the time of this report, and the CVSS vector is listed as N/A. Based on the vulnerability class and the NVD description, this would likely be rated in the High severity band (CVSS 7.0–8.9) if scored, given the confidentiality impact and the network-based attack vector, though the score would depend on authentication requirements and scope considerations.

EPSS: Not yet scored by FIRST.org; no exploitation probability data is available.

Detection Guidance

Detection of this vulnerability is challenging because the malicious payload is embedded within normal application content (notes) and is only executed during the PDF export process. Detection strategies should focus on anomalous file-access patterns by the Pandoc/XeLaTeX processes, as well as monitoring for unexpected file inclusion attempts.

Sigma Rule

title: Suspicious File Read via Pandoc/XeLaTeX PDF Export
id: 5f8f6a2e-9b43-4c92-a25d-1e8c3b6f7a10
status: experimental
description: Detects attempts to exploit CVE-2026-81659 by identifying Pandoc or XeLaTeX processes reading sensitive files outside expected document directories
author: Valtersit Threat Intelligence
logsource:
  category: process_creation
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/pandoc'
      - '/xelatex'
      - '/pdflatex'
  selection_file_access:
    CommandLine|contains:
      - '/etc/passwd'
      - '/etc/shadow'
      - '/etc/ssh'
      - '/root/'
      - '/home/'
      - '/var/lib/flowintel'
      - '/proc/self/environ'
      - '../'
      - '..\\'
  condition: selection_process and selection_file_access
falsepositives:
  - Legitimate exports referencing user profile directories (e.g., /home/user/images)
level: high
tags:
  - attack.t1005
  - attack.t1190
  - cve.2026.81659
  - cwe.22

YARA Rule

rule CVE_2026_81659_Flowintel_PDF_Export_Malicious_Content
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects note content or PDF export files containing path traversal or file inclusion patterns targeting CVE-2026-81659"
        cve = "CVE-2026-81659"
        cwe = "CWE-22"
        date = "2026-01-01"
        severity = "high"

    strings:
        $path_traversal_1 = "../../"
        $path_traversal_2 = "..\\..\\"
        $path_traversal_3 = /\.\.\/\.\.\/\.\.\/[A-Za-z0-9_\/]+/
        $latex_input_1 = /\\input\{[^\}]*\}/
        $latex_input_2 = /\\include\{[^\}]*\}/
        $latex_input_3 = /\\openin\d+=\{file[^\}]*\}/
        $pandoc_resource = "resource-path="
        $xelatex_shell_escape = "shell-escape"

    condition:
        uint16(0) == 0x5B25 or  // %[ (LaTeX comment or beginning)
        any of ($path_traversal_*) or
        any of ($latex_input_*) or
        any of ($pandoc_resource*) or
        any of ($xelatex_shell_escape*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-81659 - Flowintel PDF Export Path Traversal Attempt"; flow:established,to_server; content:"POST"; http_method; content:"export"; http_uri; nocase; content:"pdf"; http_uri; nocase; content:"note"; http_uri; nocase; content:"../"; http_client_body; nocase; content:"./"; http_client_body; nocase; pcre:"/(?:\.\./){2,}/Ri"; classtype:attempted-admin; reference:cve,2026-81659; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-81659; sid:202681659; rev:1;)

Elastic Detection

// Detect suspicious file access by Pandoc/XeLaTeX processes
process where event.action == "exec" and
  process.name in ("pandoc", "xelatex", "pdflatex") and
  (
    process.args like "*../../*" or
    process.args like "*..\\..\\*" or
    process.args like "*etc/passwd*" or
    process.args like "*etc/shadow*" or
    process.args like "*etc/ssh*" or
    process.args like "*proc/self/*" or
    process.args like "*home/*" or
    process.args like "*root/*" or
    process.args like "*flowintel*db*" or
    process.args like "*flowintel*config*"
  )

Splunk SPL Query

index=main sourcetype=linux_secure OR sourcetype=auditd
  (process="pandoc" OR process="xelatex" OR process="pdflatex")
  AND (
    args="*../../*" OR
    args="*..\\..\\*" OR
    args="*/etc/*" OR
    args="*/root/*" OR
    args="*/home/*" OR
    args="*/proc/self/*" OR
    args="*flowintel*"
  )
  OR (
    command="*pandoc*" AND command="*../../*"
  )
| stats count by host, process, command, _time
| sort - count

Wazuh OSSEC Rule

<group name="cve-2026-81659,">
  <rule id="816590" level="12">
    <if_sid>5715</if_sid>
    <match>pandoc|xelatex</match>
    <regex>\.\./\.\./|/etc/passwd|/etc/shadow|/etc/ssh</regex>
    <description>CVE-2026-81659: Potential path traversal in Flowintel PDF export via Pandoc/XeLaTeX</description>
    <group>attack.t1005,cwe_22,</group>
    <mitre>
      <id>T1005</id>
    </mitre>
  </rule>

  <rule id="816591" level="12">
    <if_sid>550</if_sid>
    <match>flowintel</match>
    <regex>\.\./\.\./</regex>
    <description>CVE-2026-81659: Path traversal pattern in Flowintel HTTP traffic</description>
    <group>attack.t1190,cwe_22,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: This vulnerability is UNPATCHED (patch confidence: 0/4). No vendor advisory, patch release, or workaround from the vendor has been identified across any tracked source. The affected versions list is empty and no OSV package data is available.

Given the absence of an official patch, the following layered mitigation strategy should be implemented:

1. Immediate Mitigations

• Disable PDF export functionality within Flowintel if it is not business-critical, eliminating the attack surface entirely. This may be achievable via feature flags or application configuration settings.
• Restrict access to Flowintel: Place the application behind a VPN or restrict access to trusted IP ranges using network ACLs or firewall rules. Ensure the application is not exposed on the public internet unless absolutely necessary.
• Enforce mandatory authentication: Disable any guest/anonymous access or self-registration. Enforce multi-factor authentication (MFA) for all user accounts, if supported by the platform.
• Apply filesystem-level controls: If administrative access to the Flowintel server is available, use AppArmor, SELinux, or seccomp to constrain the Pandoc/XeLaTeX processes, limiting their filesystem reads to expected working directories (e.g., temporary export directories) and blocking access to system-sensitive paths.
• Run Flowintel in an isolated container: If not already containerized, move the deployment into a Docker container or VM with minimal host access, restricted mounts, and a dedicated low-privilege service account.

2. Patch/Upgrade Steps

• Monitor for vendor updates: Continuously monitor the Flowintel project for advisories and version releases. Subscribe to the project's security mailing list or GitHub repository notifications.
• Apply vendor patch when available: Once a fixed version is released, upgrade all deployments as part of an expedited change management process. Validate the patch in a staging environment first.
• Validate the upgrade: After patching, verify that PDF export functionality sanitizes or blocks file-inclusion directives in note content. Test with path traversal payloads (e.g., ../../../../etc/passwd in note content) to confirm the patched version rejects or neutralizes the malicious input.

3. Long-Term Hardening

• Review note content sanitization: Implement input validation rules that strip or reject LaTeX control sequences and path traversal patterns from note content before it reaches the document processing pipeline. Consider whether removing TeX support from the export chain is feasible (e.g., using simpler rendering engines).
• Harden the processing environment: Always run Pandoc/XeLaTeX under a non-root service account with the minimum privileges required. Use filesystem policies (e.g., Landlock, AppArmor profiles) to confine the document processing to a temporary working directory.
• Deploy egress monitoring: Monitor outbound network traffic for anomalous large PDF file downloads from Flowintel, which could indicate exfiltration of embedded file contents.
• Implement anomaly-based file monitoring: Use file integrity monitoring (FIM) and auditd to track read access to sensitive files (e.g., /etc/shadow, /etc/ssh, application secrets), alerting on access from the Flowintel service account.
• Include this CVE in vulnerability scanning: Once a patch and version range are confirmed, add CVE-2026-81659 to the organization's vulnerability management program to ensure detection of affected versions during routine scanning.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-81659 — Official NVD description and metadata for CVE-2026-81659. (Note: No CVSS score assigned; CWE-22.)

2. Flowintel Project Homepage: https://github.com/Antisight/flowintel (returned 404 — verify manually) — Official Flowintel GitHub repository. Monitor this location for future security advisories and patch releases.

3. Pandoc Documentation: https://pandoc.org/MANUAL.html — Official Pandoc manual; reference for understanding the document conversion pipeline and potential file inclusion behaviors.

4. XeLaTeX Documentation: https://tug.org/xetex/ — Official XeLaTeX/TeX documentation; reference for understanding TeX file inclusion primitives relevant to this vulnerability class.

5. CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html — MITRE CWE entry for the path traversal vulnerability class.

Threat Actor Campaigns: No threat actor campaigns or exploit-in-the-wild evidence is currently associated with CVE-2026-81659 as of the publication date of this report. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public PoC or exploit code has been observed. However, the vulnerability class (unauthenticated/authenticated path traversal leading to file read) is a well-known target for opportunistic attackers scanning for exposed applications, and exploitation is considered likely once public PoC becomes available.