Code Injection Vulnerability in Dromara Warm-Flow Product
CVE-2026-6125

5.3MEDIUM

Key Information:

Vendor: Dromara
Status: Warm-flow
Vendor: CVE Published:; 12 April 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-6125?

A security flaw exists in the Dromara warm-flow product affecting versions up to 1.8.4. Specifically, the vulnerability resides in the SpelHelper.parseExpression function located in the /warm-flow/save-json file. The manipulation of parameters such as listenerPath, skipCondition, and permissionFlag can lead to a code injection attack. This exploit enables potential attackers to execute arbitrary code on the affected system, and it can be executed remotely, increasing the risk for organizations utilizing this workflow definition handler. Be aware that public exploits for this vulnerability have been disclosed.

Affected Version(s)

warm-flow 1.8.0

warm-flow 1.8.1

warm-flow 1.8.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-6125 - Proof of Concept