CVE-2026-81659
Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export.
- Published Aug 27, 2026
- CVSS 7.1 high
- 0.5% chance of exploitation in the next 30 days (EPSS)
- A fix is available