CVE-2025-11898: Flowring Technology Agentflow

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Agentflow developed by Flowring has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.

Affected products

• Flowring Technology Agentflow: version 4.0 only

Published 2025-10-17. Last modified 2026-10-09.