CVE-2022-39036: Flowring Agentflow

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary file and execute arbitrary code to manipulate system or disrupt service.

Affected products

• Flowring Agentflow: version 4.0.0.1183.552 only

Published 2022-11-10. Last modified 2026-06-17.