Remote Code Execution Vulnerability in AppFlowy by AppFlowy-IO
CVE-2026-52097

6.8MEDIUM

Key Information:

Vendor

AppFlowy-IO

Status
AppFlowy
Vendor
CVE Published:
10 September 2026

What is CVE-2026-52097?

An issue exists in AppFlowy version 0.11.8 that allows a remote attacker to execute arbitrary code. The vulnerability arises from components such as afLaunchUri, _afLaunchLocalUri in url_launcher.dart, and OpenFilex.open alongside localPathRegex in common_patterns.dart. This exploitation can lead to unauthorized actions within the application, posing serious security risks to users.

References

https://github.com/AppFlowy-IO/AppFlowy
https://github.com/AppFlowy-IO/AppFlowy/blob/main/fronten...
https://github.com/AppFlowy-IO/AppFlowy/blob/main/fronten...

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.