CVE-2026-6125: Dromara Warm-Flow

Medium severity, CVSS 6.3. EPSS: 0.4% chance of exploitation in the next 30 days.

A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

Affected products

• Dromara Warm-Flow: version 1.8.0 only; version 1.8.1 only; version 1.8.2 only; version 1.8.3 only; version 1.8.4 only

Published 2026-04-12. Last modified 2026-06-17.