CVE-2026-2097: Flowring｜Agentflow - Arbitrary File Upload
Published Feb 10, 2026
·Updated
Agentflow developed by Flowring has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Affected Software
2 affected components
Flowring Agentflow
Flowring Agentflow
Event History
Feb 10, 2026
CVE Published
via MITRE·07:02 AM
Data Sourced
via MITRE·07:02 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-2097?
CVE-2026-2097 has a high severity due to its potential for arbitrary code execution.
2
How do I fix CVE-2026-2097?
To fix CVE-2026-2097, ensure that file upload restrictions are implemented and validate file types before allowing uploads.
3
Who is affected by CVE-2026-2097?
CVE-2026-2097 affects users of the Flowring Agentflow application.
4
What does CVE-2026-2097 allow attackers to do?
CVE-2026-2097 allows authenticated attackers to upload and execute web shell backdoors on the server.
5
Is there a known exploit for CVE-2026-2097?
Yes, there are known exploits for CVE-2026-2097 that take advantage of the arbitrary file upload vulnerability.