CVE-2026-96431: Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote user must be authenticated to exploit the vulnerable upload endpoint. The available information does not indicate that unauthenticated users can exploit it.
What access or action is required for exploitation?
An authenticated attacker needs to upload a malicious file through the /WebAgenda/download/uploadFile.jsp API endpoint. Successful exploitation can result in arbitrary system command execution.
Which deployments are affected?
Flowring Agentflow 4.0 versions before 2023/03/24 are identified as affected. The provided information does not state whether the endpoint is enabled or exposed in default configurations.