CVE-2026-39915 in TIM Flow
Summary
by MITRE • 08/24/2026
TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter and access_token cookie, which are reflected into Set-Cookie response headers. Attackers can craft malicious requests to induce authenticated users to execute arbitrary JavaScript in their browser context, enabling session token theft and account credential modification.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified within TIM Flow versions prior to 26.0.6 represents a critical server-side input validation failure that facilitates both Cross-Site Scripting and HTTP Response Splitting attacks. This flaw stems from the application's inadequate sanitization of user-supplied data specifically found in the rt URL parameter and the access_token cookie. When these inputs are processed, the system fails to strip or encode carriage return (CR) and line feed (LF) characters before incorporating them into outgoing HTTP responses. Consequently, an attacker can inject arbitrary CRLF sequences that effectively terminate the current HTTP header block and initiate a new one. This behavior allows for the injection of custom headers as well as the insertion of content directly into the response body, fundamentally breaking the expected structure of the HTTP protocol exchange between the server and the client browser.
From a technical perspective, this vulnerability is classified under CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component, specifically manifesting through CRLF injection mechanisms often associated with CWE-93. The exploitation vector relies on the reflection of unsanitized input into Set-Cookie response headers. By embedding encoded CR and LF characters within the rt parameter or access_token cookie, an attacker can manipulate the HTTP response structure. This manipulation enables the insertion of arbitrary JavaScript code directly into the HTML body of the response or the setting of malicious cookies with specific flags such as HttpOnly bypasses if not properly configured elsewhere in the application stack. The presence of these injected elements allows for a hybrid attack scenario where traditional Cross-Site Scripting techniques are augmented by HTTP Response Splitting capabilities, significantly increasing the potential impact on system integrity and user data confidentiality.
The operational impact of this vulnerability is severe, primarily due to its ability to facilitate session hijacking and account compromise through malicious JavaScript execution in the victim's browser context. When an authenticated user accesses a crafted URL or interacts with a compromised page that triggers this injection, the injected script executes within the security context of the TIM Flow application domain. This allows attackers to steal sensitive session tokens, which can be used to impersonate legitimate users and gain unauthorized access to their accounts. Furthermore, the ability to modify response content enables credential harvesting through fake login forms or direct modification of account settings by injecting scripts that alter form submissions. The attack aligns with MITRE ATT&CK techniques such as T1059 Command and Scripting Interpreter for executing arbitrary code via injected JavaScript, and potentially T1534 Internal Spearphishing if used in targeted campaigns to redirect users to malicious sites or steal credentials through phishing pages hosted on the compromised domain.
Mitigation strategies must focus on immediate input validation and output encoding practices within the TIM Flow application logic. Developers should implement strict allow-listing for all user-supplied inputs, ensuring that special characters including carriage returns and line feeds are rejected at the entry point rather than relying solely on downstream filtering. Additionally, applying robust output encoding when rendering data into HTTP headers or HTML bodies is essential to neutralize any residual malicious content. Upgrading to version 26.0.6 or later is the primary remediation step as it addresses these validation gaps. In environments where immediate patching is not feasible, deploying a Web Application Firewall with rules capable of detecting and blocking CRLF injection patterns in URL parameters and cookies can provide an effective compensating control to mitigate exploitation attempts until the software update is applied.