CVE-2026-2536: opencc JFlow XXE Vulnerability

CVE-2026-2536 Overview

A vulnerability has been identified in opencc JFlow up to version 20260129. This vulnerability affects the Imp_Done function within the file src/main/java/bp/wf/httphandler/WF_Admin_AttrFlow.java of the Workflow Engine component. By manipulating the File argument, an attacker can exploit an XML External Entity (XXE) reference vulnerability. The attack can be initiated remotely over the network. The exploit has been publicly disclosed and may be utilized by threat actors. The JFlow project maintainers were informed of this vulnerability through an issue report but have not yet responded.

Critical Impact
Remote attackers with low-level privileges can exploit this XXE vulnerability to potentially access sensitive files, perform server-side request forgery, or cause denial of service conditions in JFlow workflow engine deployments.

Affected Products

opencc JFlow up to version 20260129
JFlow Workflow Engine (WF_Admin_AttrFlow component)
Systems utilizing the Imp_Done function for file processing

Discovery Timeline

February 16, 2026 - CVE-2026-2536 published to NVD
February 18, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2536

Vulnerability Analysis

This vulnerability is classified as CWE-610 (Externally Controlled Reference to a Resource in Another Sphere), specifically manifesting as an XML External Entity (XXE) injection vulnerability. The flaw resides in the Imp_Done function within the WF_Admin_AttrFlow.java file, which is part of JFlow's Workflow Engine component.

The vulnerability occurs when the application processes XML input without properly restricting external entity references. When an attacker supplies a maliciously crafted XML file through the File argument, the XML parser may resolve external entities, potentially leading to sensitive data disclosure, server-side request forgery (SSRF), or denial of service through entity expansion attacks (also known as "billion laughs" attacks).

The network-based attack vector with low privilege requirements makes this vulnerability accessible to authenticated remote attackers. The impact affects confidentiality, integrity, and availability at a low level within the local scope, without propagating to connected systems.

Root Cause

The root cause of this vulnerability lies in the insecure configuration of the XML parser used by the Imp_Done function. The parser does not disable external entity processing or Document Type Definition (DTD) processing, allowing attackers to inject malicious XML content that references external resources. When processing user-controlled XML files, the application fails to validate or sanitize external entity declarations before parsing, enabling the exploitation of this XXE weakness.

Attack Vector

The attack can be executed remotely over the network by any authenticated user with low-level privileges. An attacker would craft a malicious XML file containing external entity declarations and submit it through the workflow engine's file import functionality. When the Imp_Done function processes this file, the XML parser resolves the external entities, potentially:

Reading local files on the server and exfiltrating their contents
Making outbound HTTP requests to internal or external systems (SSRF)
Causing resource exhaustion through recursive entity expansion
Accessing internal network resources that should not be exposed

The vulnerability has been publicly disclosed through the Gitee Issue Discussion IDN7GT, and detailed threat intelligence is available via the VulDB Threat Intelligence Report.

Detection Methods for CVE-2026-2536

Indicators of Compromise

Unusual XML file uploads containing DOCTYPE declarations with ENTITY definitions referencing external URLs or local file paths
Server-side requests to unexpected internal or external endpoints originating from the JFlow application
Error messages or logs indicating XML parsing failures related to external entity resolution
Abnormal file read operations targeting sensitive system files such as /etc/passwd or configuration files

Detection Strategies

Monitor and analyze incoming XML payloads for DOCTYPE declarations, especially those containing SYSTEM or PUBLIC entity references
Implement web application firewall (WAF) rules to detect and block common XXE attack patterns in HTTP request bodies
Configure application logging to capture XML parsing events and flag attempts to resolve external entities
Deploy SentinelOne endpoint protection to detect post-exploitation activities such as unauthorized file access or outbound connections from the JFlow application process

Monitoring Recommendations

Enable verbose logging for the JFlow Workflow Engine, specifically for the WF_Admin_AttrFlow component
Set up alerts for unusual network connections originating from the Java process running JFlow
Monitor file system access patterns for the JFlow application, particularly access to sensitive system files outside the application directory
Review audit logs for failed authentication attempts followed by file upload activities

How to Mitigate CVE-2026-2536

Immediate Actions Required

Disable or restrict access to the Imp_Done function in WF_Admin_AttrFlow.java until a patch is available
Implement strict input validation for all XML file uploads, rejecting files with DOCTYPE declarations
Configure the XML parser to disable external entity and DTD processing by setting appropriate parser features
Apply network segmentation to limit the JFlow server's ability to make outbound connections

Patch Information

As of the last update on February 18, 2026, the JFlow project maintainers have not responded to the vulnerability report submitted through the Gitee issue tracker. Organizations using JFlow should monitor the JFlow repository for security updates and consider implementing the workarounds below until an official patch is released.

Workarounds

Configure the XML parser to disable external entities by setting XMLConstants.FEATURE_SECURE_PROCESSING to true and disabling XMLConstants.ACCESS_EXTERNAL_DTD
Deploy a web application firewall with rules specifically targeting XXE attack patterns in uploaded XML content
Implement file type validation at the application layer to ensure only expected file formats are processed
Restrict network access for the JFlow server to prevent exploitation of SSRF through XXE

bash

# Configuration example for restricting external network access (iptables)
# Block outbound connections from JFlow application user to prevent SSRF exploitation
iptables -A OUTPUT -m owner --uid-owner jflow -p tcp --dport 80 -j DROP
iptables -A OUTPUT -m owner --uid-owner jflow -p tcp --dport 443 -j DROP
iptables -A OUTPUT -m owner --uid-owner jflow -p tcp --dport 8080 -j DROP