| 제목 | https://gitee.com/lwj/flow flowable 1.0 Arbitrary File Upload |
|---|
| 설명 | Arbitrary File Upload in flowable v1.0 via /front/flow/uploadFile/ Due to Insecure Extension and Content-Type Validation,Vulnerability file: \flow-master\flow-front-rest\src\main\java\com\dragon\flow\web\resource\flow\FormResource.java，Attackers may use HTML or SVG file uploads to achieve stored XSS, further stealing administrator sessions or laterally penetrating process systems. This vulnerability has exposed a significant oversight by the development team in the design of file upload security |
|---|
| 원천 | ⚠️ https://gitee.com/lwj/flow/issues/IDIQSE |
|---|
| 사용자 | MaoQiu (UID 94327) |
|---|
| 제출 | 2026. 01. 09. AM 08:35 (9 개월 ago) |
|---|
| 모더레이션 | 2026. 01. 17. PM 07:20 (8 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 341718 [lwj flow 까지 a3d2fe8133db9d3b50fda4f66f68634640344641 SVG File FormResource.java uploadFile file 권한 상승] |
|---|
| 포인트들 | 20 |
|---|