CVE-2026-52097: AppFlowy vulnerability
An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, afLaunchLocalUri (urllauncher.dart), OpenFilex.open, localPathRegex (commonpatterns.dart) components
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The issue is described as remotely exploitable, so an attacker does not need local access to the affected AppFlowy installation. The provided information does not specify the user interaction or input-delivery conditions required.
Which AppFlowy version is identified as affected?
AppFlowy 0.11.8 is identified in the available information. No fixed version or patch availability is provided.
What components should be prioritized during investigation?
Prioritize uses of afLaunchUri, _afLaunchLocalUri in url_launcher.dart, OpenFilex.open, and localPathRegex in common_patterns.dart. These components are identified as the paths involved in arbitrary code execution.