EUVD-2026-89713
GHSA-qg6g-m898-7whg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable web app (AV:N), simple traversal (AC:L), requires a low-privileged authenticated account (PR:L), file-read gives high confidentiality only (C:H, I/A:N).
Primary rating from Vendor (twcert).
CVSS VectorVendor: twcert
Lifecycle Timeline
2DescriptionCVE.org
EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files.
AnalysisAI
Arbitrary file read in Digiwin EasyFlow .NET allows an authenticated remote user to download files from the underlying host outside the intended document scope, exposing configuration files, credentials, or other sensitive data. Exploitation requires a valid low-privilege session (PR:L per the CVSS v4.0 vector and the corroborating CVSS v3.1 assessment) but no user interaction and only low attack complexity, so any party holding a legitimate account can reach the flaw over the network. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the Digiwin EasyFlow .NET application (PR:L) reachable over the network; the attacker abuses a file-download/path-handling feature by supplying directory-traversal input to read files outside the intended scope. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-risk, authenticated confidentiality flaw rather than a high-urgency emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified in the available intelligence at time of analysis, so the immediate priority is verifying status with Digiwin and monitoring the TWCERT advisories (https://www.twcert.org.tw/en/cp-139-11242-13f37-2.html) for a fixed build before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Digiwin EasyFlow .NET deployments, restrict network access to trusted administrative networks, enforce least privilege and MFA for all accounts, and enable detailed file-access logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Easyflow Net
View allSQL Injection in Digiwin EasyFlow .NET enables unauthenticated remote attackers to execute arbitrary SQL commands agains
Critical SQL injection in Digiwin EasyFlow .NET allows unauthenticated remote attackers to execute arbitrary SQL command
Unauthenticated remote attackers can retrieve other users' plaintext passwords from Digiwin EasyFlow .NET via a specific
Unauthenticated remote code execution affects Digiwin EasyFlow .NET, which deserializes attacker-supplied serialized con
Authenticated administrative users of Digiwin EasyFlow .NET can exploit an arbitrary file upload vulnerability to place
Session fixation in Digiwin EasyFlow .NET allows unauthenticated remote attackers to pre-set a victim's session identifi
SQL injection in Digiwin EasyFlow .NET allows an authenticated, low-privilege remote user to read arbitrary contents of
Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately fi
Reflected cross-site scripting in Digiwin EasyFlow .NET allows unauthenticated remote attackers to execute arbitrary Jav
Stored Cross-Site Scripting in Digiwin's EasyFlow .NET workflow platform enables authenticated low-privilege attackers t
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today