CVE-2026-96440
Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via the path parameter.
| CWE | CWE-22 |
| Vendor | flowring technology corp |
| Product | agentflow 4.0 |
| Published | Sep 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for flowring technology corp agentflow 4.0
Be the first to know when new unknown vulnerabilities affecting flowring technology corp agentflow 4.0 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Flowring Technology Corp / Agentflow 4.0
0 < 2023/03/24