Agentflow
CVE-2026-2097
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Agentflow application
-
DeliveryLocate file upload functionality
-
ExploitUpload malicious web shell file
-
ExecutionAccess uploaded shell via HTTP request
-
ImpactExecute arbitrary commands on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated user account required for Agentflow application. Attacker must have valid credentials to access the upload feature. Default Agentflow installations with file upload enabled and insufficient file type validation are vulnerable. |
| Impact | CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation requires authentication. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker (requires authentication) could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Agentflow versions up to - is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
RemediationAI
Monitor vendor advisories for a patch. Validate file types by content. Store uploads outside web root. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-434: Unrestricted Upload of File with Dangerous Type) affects Agentflow. Agentflow developed by Flowring has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Know when Agentflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Agentflow developed by Flowring has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
Executive ViewAI
Agentflow instances are vulnerable to arbitrary file uploads that could allow attackers to execute malicious code and compromise affected systems. This vulnerability impacts any organization using Agentflow and requires immediate mitigation since vendor patches are not yet available.
Disable or restrict file upload features in Agentflow if not critical to operations; implement Web Application Firewall (WAF) rules to filter dangerous file types (executables, scripts, archives); enforce strict file type validation and MIME type checking; apply network segmentation to limit lateral movement from compromised Agentflow instances; enable enhanced logging and monitoring for upload activities; restrict Agentflow service account permissions; consider air-gapping critical Agentflow instances until patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Authentication bypass in Flowring Agentflow workflow system allows unauthenticated remote attackers to exploit specific
Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attacker
Missing authentication in Flowring Agentflow allows unauthenticated attackers to read, modify, and delete data. Second a
The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. Rated critical seve
Agentflow BPM enterprise management system has improper authentication. Rated high severity (CVSS 8.8), this vulnerabili
Arbitrary code execution in berabuddies AgentFlow (all versions prior to fix commit 1667fa3) allows attackers to run loc
Agentflow BPM file download function has a path traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerabil
Reflected XSS in AgentFlow enables unauthenticated attackers to inject malicious JavaScript that executes in victims' br
Authenticated attackers can inject malicious JavaScript into Flowring's AgentFlow platform that persists and executes in
Content-type validation bypass in AgentFlow's localhost web API allows browser-driven cross-origin requests to reach the
GitHub PoC
Exploit-DB