CVE-2026-96431

Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file.

  • Published Sep 29, 2026
  • CVSS 9.3 critical
  • 0.3% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-96431 at the National Vulnerability Database