CVE-2026-96440 in Agentflow
Summary
by MITRE • 09/29/2026
Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via the path parameter.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal or Directory Traversal, affects the Flowring Agentflow software in versions prior to 2023/03/24. This security flaw resides specifically within the /WebAgenda/download/uploadFile.jsp API endpoint. The core technical issue stems from insufficient validation and sanitization of user-supplied input passed via the path parameter. When a remote authenticated user submits a request containing directory traversal sequences, such as dot-dot-slash (../) or their URL-encoded equivalents, the application fails to properly restrict the file operation to the intended upload directory. Instead, the backend logic interprets these sequences literally and resolves them relative to the current working directory of the web server process. This allows an attacker to manipulate the filesystem path to write files to arbitrary locations on the underlying operating system that are outside the scope of the designated secure folder.
From a technical perspective, this vulnerability represents a classic input validation failure where the application trusts user-controlled data without verifying its integrity or context. The lack of canonicalization checks means that relative paths provided by the attacker can escape the sandboxed environment intended for file uploads. This is particularly dangerous because it grants an authenticated actor significant control over the server's filesystem structure. While authentication is required to exploit this flaw, which limits the attack surface compared to unauthenticated variants, it still poses a severe risk in environments where credentials may be compromised through phishing, credential stuffing, or other means of account takeover. The ability to write files outside the restricted directory effectively bypasses security controls designed to contain malicious uploads within a specific quarantine zone.
The operational impact of this vulnerability is substantial and multifaceted. An attacker who successfully exploits this path traversal flaw can upload arbitrary file types to sensitive system directories, such as web root folders or configuration directories. This capability facilitates Remote Code Execution (RCE) if the uploaded files are executable scripts or binaries that can be invoked by a service running with elevated privileges. For instance, writing a malicious JSP shell into a directory accessible by the web server allows for immediate command execution on the host machine. Furthermore, overwriting existing configuration files could lead to privilege escalation or complete system compromise. The vulnerability also enables data exfiltration if sensitive files can be read through similar mechanisms, although this specific description focuses primarily on write capabilities. In enterprise environments running Flowring Agentflow, such a flaw undermines the integrity of the application and potentially exposes critical business logic and customer data stored within the infrastructure.
This issue aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory in the Common Weakness Enumeration database, which categorizes weaknesses related to path traversal attacks that allow access to files or directories outside the intended scope. Additionally, from an offensive security perspective, this vulnerability maps to MITRE ATT&CK technique T1083: File and Directory Discovery, specifically when used as a precursor to T1105: Ingress Tool Transfer or T1204: User Execution if malicious files are uploaded for later activation. The exploitation chain typically involves reconnaissance followed by the injection of traversal characters into the path parameter during file upload operations.
Mitigation strategies must address both immediate remediation and long-term defensive posture improvements. The primary and most effective mitigation is to upgrade Flowring Agentflow to version 2023/03/24 or later, where this specific flaw has been addressed by the vendor through improved input validation logic. For systems that cannot be immediately patched, administrators should implement strict allow-listing for file names and paths on the server side rather than relying solely on blacklist approaches which are prone to bypasses via encoding variations. Web Application Firewalls (WAFs) can provide a temporary layer of defense by detecting and blocking requests containing common path traversal patterns such as ../ or ..%2f in query parameters and POST bodies, although this is not a substitute for code-level fixes. Additionally, ensuring that the web server process runs with minimal privileges limits the potential damage if an upload succeeds, adhering to the principle of least privilege. Regular security audits and static application security testing (SAST) should be integrated into the development lifecycle to detect such input validation weaknesses before deployment.