CVE-2022-39036

CRITICAL

Agentflow BPM - RCE

Title source: llm
STIX 2.1

Description

The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary file and execute arbitrary code to manipulate system or disrupt service.

Scores

CVSS v3 9.8
EPSS 0.0610
EPSS Percentile 90.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-434
Status published
Products (1)
flowring/agentflow 4.0.0.1183.552
Published Nov 10, 2022
Tracked Since Feb 18, 2026