CVE-2022-39036 FLOWRING Agentflow BPM - Arbitrary File Upload
Unauthenticated attackers can upload arbitrary files to execute code or disrupt services in FLOWRING Agentflow BPM.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-39036?
CVE-2022-39036 is a critical vulnerability in FLOWRING Agentflow BPM, published on 10 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary file and execute arbitrary code to manipulate system or disrupt service.
Weakness: CWE-434
Which versions are affected by CVE-2022-39036?
It affects 1 product.
Products include Flowring Agentflow.
How do I fix CVE-2022-39036?
No fix has been published for CVE-2022-39036 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-39036 being exploited?
There is no known exploitation of CVE-2022-39036 in the wild and no public exploit code.
Other vulnerabilities in FLOWRING Agentflow BPM
- CVE-2025-3709 Flowring Technology Agentflow - Account Lockout Bypass
- CVE-2026-2095 Flowring｜Agentflow - Authentication Bypass
- CVE-2026-2096 Flowring｜Agentflow - Missing Authenticaton
- CVE-2022-39038 FLOWRING Agentflow BPM - Broken Access Control
- CVE-2026-2097 Flowring｜Agentflow - Arbitrary File Upload
Sources
Also known as GHSA-4g6w-wv86-3h78.