CVE-2026-91197: Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations with external entities in BPMN files to read arbitrary local files or trigger requests to internal network endpoints when diagram layout is computed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
flowable/flowable-engineto a version that resolves this vulnerability.Fixed in 8.0.0
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker needs process deployment privileges. They can place a BPMN file containing a DOCTYPE declaration with external entities into a deployed process.
When is a malicious BPMN resource processed?
The external entity is resolved when diagram layout is computed for the deployed BPMN resource. Systems that allow process deployment and generate process diagrams are therefore the relevant exposure scenario.
What could an attacker obtain or reach through exploitation?
An attacker may read arbitrary local files accessible to the Flowable process or cause requests to internal network endpoints. The issue affects confidentiality; no integrity or availability impact is specified.