CVE-2026-96431 in Agentflow
Summary
by MITRE • 09/29/2026
Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as an unrestricted upload of a file with a dangerous type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow version 4.0 prior to the March 24, 2023 release represents a critical security flaw that compromises the integrity and availability of the affected system. This specific implementation error allows remote authenticated users to bypass file validation mechanisms by uploading files containing executable code or scripts rather than benign data types such as images or documents. The core technical deficiency lies in the server-side logic which fails to adequately sanitize, validate, or restrict the MIME type, extension, and content of uploaded files against a strict allowlist. Consequently, an attacker who possesses valid credentials can exploit this weakness by crafting a malicious file that mimics a legitimate document but contains embedded commands designed for execution on the underlying operating system.
From a technical perspective, the vulnerability stems from insufficient input validation at the point where user-supplied data is processed and stored within the application's directory structure. When the uploadFile.jsp endpoint receives the request, it likely relies on client-side checks or weak server-side heuristics that can be easily circumvented using standard web proxy tools to modify file headers or extensions. Once the malicious file is successfully uploaded to a location where the web server interprets and executes files with specific extensions such as JSP, PHP, or ASPX, it becomes accessible via HTTP requests. This scenario effectively transforms the application into an arbitrary code execution vector because the web container will process the script content within the uploaded file, running commands under the privileges of the web service account.
The operational impact of this vulnerability is severe and multifaceted. Successful exploitation allows attackers to achieve remote code execution with the same permissions as the web server process, which often includes read-write access to application directories and potentially broader system-level rights depending on how the application is deployed. This capability enables a wide range of malicious activities including data exfiltration, installation of backdoors for persistent access, deployment of ransomware, or using the compromised host as a pivot point to attack other systems within the internal network. The presence of authentication requirements does not mitigate this risk significantly in enterprise environments where credential theft via phishing, brute force attacks, or session hijacking is common, thereby expanding the potential threat surface considerably.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-434, which describes an unrestricted upload of a file with a dangerous type. It also maps to MITRE ATT&CK technique T1505.003, known as Web Shell: JSP Web Shell, indicating that the attacker utilizes uploaded scripts to maintain control over the compromised server. Furthermore, it relates to CWE-20 Improper Input Validation and CWE-79 Cross-site Scripting if the application reflects user input without proper encoding, although in this specific case, the primary concern is direct code execution rather than client-side attacks. The lack of strict file type verification violates fundamental secure coding principles that mandate treating all external inputs as untrusted until proven safe through rigorous validation processes.
To mitigate this vulnerability and prevent similar issues across software ecosystems, developers must implement a robust allowlist approach for file uploads. This involves validating the file extension against a predefined list of acceptable types such as .jpg, .png, or .pdf while rejecting any executable extensions like .jsp, .php, .exe, or .sh. Additionally, content verification should be performed by inspecting the actual binary signature of the file rather than relying solely on metadata headers which are easily spoofed. Uploaded files should be stored in a directory that is not accessible for execution by the web server, ensuring that even if malicious files are uploaded, they cannot be interpreted as code. Implementing randomization of filenames upon upload further reduces predictability and complicates exploitation attempts. Organizations relying on Flowring Agentflow 4.0 must immediately apply the patch released after March 24, 2023 to address these flaws and enforce strict access controls alongside regular security audits to detect any unauthorized file uploads that may have occurred prior to remediation.