Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-96440

Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
ZUSO ART

Description

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via the path parameter.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Flowring Technology Corp Agentflow 4.0

Default version status: unaffected

  • 0 to < 2023/03/24affected

References