VulnSocial

CVE-2020-29134Disclosure(totvs / fluig)

LOWCVSS 8.6 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

The TOTVS Fluig platform allows path traversal through the parameter "file = .. /" encoded in base64. This affects all versions Fluig Lake 1.7.0, Fluig 1.6.5 and Fluig 1.6.4

totvs CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-22

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • fluig

Threat summary

  • Public PoC is present in monitored signal
  • 1 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
totvs
Products
fluig

3 versions affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-09: 1PoC Mentioned / Linked · 2026-09-09: 1Technical Details · 2026-09-09: 109-09
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2020-29134 - high 🚨 TOTVS Fluig <= 1.7.0 - Arbitrary File Read > TOTVS Fluig platform contains a path traversal caused by base64-encoded manipulation ... 👾 https://cloud.projectdiscovery.io/library/CVE-2020-29134 @pdnuclei #NucleiTemplates #cve

    Post summary

    The tweet discloses a high‑severity path‑traversal vulnerability (CVE‑2020‑29134) affecting TOTVS Fluig (≤1.7.0), describing how base64 manipulation leads to arbitrary file read and links to a Project Discovery library page that likely contains a PoC.

    00001290
    1.3K followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Apptotvsfluig1.6.4--
Apptotvsfluig1.6.5--
Apptotvsfluig1.7.0--

Explore more

Back to dashboardtotvs CVEsfluig vulnerabilities