Unrestricted File Upload in Flowring Agentflow Affects Remote Users
CVE-2026-96431

9.3CRITICAL

Key Information:

Vendor

Flowring Technology Corp

Status
Agentflow 4.0
Vendor
CVE Published:
29 September 2026

What is CVE-2026-96431?

The Flowring Agentflow platform is susceptible to a significant security risk due to an unrestricted file upload vulnerability in the /WebAgenda/download/uploadFile.jsp API endpoint. This flaw permits remote authenticated users to upload malicious files, potentially leading to the execution of arbitrary system commands. This vulnerability underscores the importance of implementing strict file type checks and validation procedures to protect web applications from unauthorized access and exploitation.

Affected Version(s)

Agentflow 4.0 0 < 2023/03/24

References

https://zuso.ai/cve-advisory/advisory
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.