EUVD-2026-88662
GHSA-gchq-2h86-x245
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable JSP endpoint (AV:N/AC:L), requires a low-privilege authenticated account (PR:L), no user interaction, and file-upload-to-RCE yields full host compromise (C/I/A:H); scope unchanged as code runs in the web app context.
Primary rating from Vendor (ZUSO ART).
CVSS VectorVendor: ZUSO ART
Lifecycle Timeline
3DescriptionCVE.org
Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.
AnalysisAI
Remote code execution in Flowring Agentflow 4.0 is possible through the /WebAgenda/download/uploadFile.jsp endpoint, where authenticated low-privilege users can upload a file of dangerous type that the server then executes. Affected deployments are builds prior to 2023/03/24, and exploitation requires a valid application session but no victim interaction; no public exploit has been identified at time of analysis, though the technical impact is severe and warrants urgent patching.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid low-privilege authenticated session (PR:L) on the Flowring Agentflow 4.0 web application to reach the /WebAgenda/download/uploadFile.jsp upload endpoint; the instance must be running a build prior to 2023/03/24. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-risk vulnerability by technical impact: CWE-434 unrestricted file upload leading to arbitrary system command execution is a direct path to remote code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor fix by upgrading Flowring Agentflow 4.0 to a build dated 2023/03/24 or later; the advisory is at https://zuso.ai/cve-advisory/advisory and should be consulted for the exact package or build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Flowring Agentflow 4.0 installations and identify any builds prior to 2023/03/24; immediately restrict or disable access to the /WebAgenda/download/uploadFile.jsp endpoint where business operations permit, apply WAF or reverse-proxy rules to block dangerous file uploads, and enforce least privilege for application sessions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Agentflow 4 0
View allUnauthenticated SQL injection in Flowring Agentflow 4.0 allows any remote attacker who can reach the web interface to ex
Unauthenticated SQL injection in Flowring Agentflow 4.0 lets remote attackers run arbitrary SQL commands against the app
Authenticated remote attackers can execute arbitrary SQL commands against Flowring Agentflow 4.0 through the /WebAgenda/
Remote authenticated attackers can write files to arbitrary locations in Flowring Agentflow 4.0 via a path traversal fla
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today