CVE-2022-39036 CRITICAL

CVE-2022-39036: FLOWRING Agentflow BPM - Arbitrary File Upload

Vendor Flowring
Product Agentflow BPM
Weakness CWE-434 · Unrestricted file upload
Published November 10, 2022
Last update May 1, 2025
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary file and execute arbitrary code to manipulate system or disrupt service.

Key dates

02Disclosure timeline

November 10, 2022 CVE published
May 1, 2025 Record updated