CVE-2026-91197
Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations with external entities in BPMN files to read arbitrary local files or trigger requests to internal network endpoints when diagram layout is computed.
| CWE | CWE-611 |
| Vendor | flowable |
| Product | flowable-engine |
| Published | Sep 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for flowable flowable-engine
Be the first to know when new medium vulnerabilities affecting flowable flowable-engine are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
flowable / flowable-engine
0 ≤ 8.0.0
References
github.com: https://github.com/flowable/flowable-engine/issues/4216 github.com: https://github.com/flowable/flowable-engine github.com: https://github.com/flowable/flowable-engine/blob/0779d68e5a3385b74d8acb8bc37901ff54513249/modules/flowable-engine/src/main/java/org/flowable/engine/impl/bpmn/diagram/ProcessDiagramLayoutFactory.java#L101-L118 github.com: https://github.com/flowable/flowable-engine/blob/0779d68e5a3385b74d8acb8bc37901ff54513249/modules/flowable5-engine/src/main/java/org/activiti/engine/impl/bpmn/diagram/ProcessDiagramLayoutFactory.java#L97-L114 vulncheck.com: https://www.vulncheck.com/advisories/flowable-flowable-engine-through-8.0.0-xxe-via-processdiagramlayoutfactory
Credits
🔍 George Chen