EUVD-2026-75622
GHSA-7fmm-xcgh-ggrf
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
URI/file-launch components are triggered by document content, implying network delivery with required user interaction (UI:R), not physical access.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, localPathRegex (common_patterns.dart) components
AnalysisAI
Code injection in AppFlowy 0.11.8 allows arbitrary code execution through insufficient URI and local path validation in the application's file-launch and URL-handling subsystems. The vulnerability exists in the Flutter-based desktop/mobile productivity app's afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, and localPathRegex (common_patterns.dart) components, where inadequate sanitization of URI schemes or local file paths enables an attacker to trigger execution of arbitrary code. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim opens a crafted AppFlowy document, workspace page, or file reference containing a malicious URI or local path in AppFlowy 0.11.8. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | There is a notable conflict between the submitted CVSS vector (AV:P - Physical) and the description's characterization of 'remote attacker.' A physical access vector would require hands-on device access, reducing real-world risk substantially; however, the nature of the affected components (URI launchers, file openers, collaborative document app) strongly suggests the actual attack surface is network-reachable through crafted shared content, deep links, or embedded URIs within documents imported or synced by victims - implying AV:N with UI:R is more accurate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the references point only to source files on the main branch rather than a tagged release or security advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today