CVE-2026-6125: Dromara Warm-Flow RCE Vulnerability

CVE-2026-6125 Overview

A code injection vulnerability has been discovered in Dromara warm-flow versions up to 1.8.4. The vulnerability affects the SpelHelper.parseExpression function within the /warm-flow/save-json endpoint of the Workflow Definition Handler component. Remote attackers can exploit this flaw by manipulating the listenerPath, skipCondition, or permissionFlag arguments to inject and execute arbitrary code. The exploit has been publicly released and may be actively used in attacks.

Critical Impact

Authenticated remote attackers can inject arbitrary code through Spring Expression Language (SpEL) parsing, potentially leading to remote code execution, data exfiltration, or complete system compromise.

Affected Products

• Dromara warm-flow versions up to and including 1.8.4
• Systems using the Workflow Definition Handler component
• Applications exposing the /warm-flow/save-json endpoint

Discovery Timeline

• 2026-04-12 - CVE CVE-2026-6125 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-6125

Vulnerability Analysis

This vulnerability is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly known as injection. The flaw resides in the Spring Expression Language (SpEL) parsing functionality within the warm-flow workflow engine. When processing workflow definitions through the /warm-flow/save-json endpoint, the application fails to properly sanitize user-controlled input before passing it to the SpEL expression parser.

The vulnerable function SpelHelper.parseExpression accepts untrusted input from workflow definition parameters without adequate validation. This allows attackers with authenticated access to craft malicious SpEL expressions that execute arbitrary Java code within the application context.

Root Cause

The root cause is insufficient input validation and sanitization in the SpelHelper.parseExpression function. The application directly processes user-supplied values from the listenerPath, skipCondition, and permissionFlag parameters without proper escaping or validation, enabling SpEL injection attacks. SpEL expressions are powerful and can invoke arbitrary Java methods, access system resources, and execute operating system commands when improperly handled.

Attack Vector

The attack is network-based and can be executed remotely by authenticated users. An attacker submits a crafted HTTP request to the /warm-flow/save-json endpoint with malicious SpEL expressions embedded in the vulnerable parameters. The server-side SpEL parser then evaluates these expressions, executing the attacker's injected code with the privileges of the application.

The vulnerability can be exploited by injecting malicious SpEL syntax into workflow definition fields. For example, expressions such as T(java.lang.Runtime).getRuntime().exec() patterns could be embedded in the listenerPath, skipCondition, or permissionFlag parameters to achieve command execution. Technical details are available in the Gitee Issue IHURVQ and the VulDB Vulnerability Entry.

Detection Methods for CVE-2026-6125

Indicators of Compromise

• Unusual HTTP POST requests to /warm-flow/save-json containing SpEL syntax patterns such as T(, Runtime, or exec(
• Workflow definitions with suspicious expressions in listenerPath, skipCondition, or permissionFlag fields
• Unexpected process spawning or outbound network connections from the warm-flow application server

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SpEL injection patterns in request parameters
• Monitor application logs for parsing errors or exceptions related to SpelHelper.parseExpression
• Deploy intrusion detection rules to identify command execution patterns originating from Java-based applications
• Review stored workflow definitions for anomalous or malicious expression syntax

Monitoring Recommendations

• Enable detailed logging for all requests to the /warm-flow/save-json endpoint
• Configure alerting for unusual process creation or network activity from the application server
• Implement file integrity monitoring on critical system directories
• Monitor for signs of lateral movement following potential exploitation

How to Mitigate CVE-2026-6125

Immediate Actions Required

• Restrict network access to the /warm-flow/save-json endpoint to trusted administrative users only
• Implement input validation on all workflow definition parameters, especially listenerPath, skipCondition, and permissionFlag
• Deploy WAF rules to filter SpEL injection attempts
• Consider disabling or removing the Workflow Definition Handler if not actively required

Patch Information

No official patch information was available at the time of publication. Monitor the Dromara warm-flow project repository for security updates. Users should upgrade to versions higher than 1.8.4 once a patched release becomes available.

Workarounds

• Implement strict input whitelisting for workflow definition fields, rejecting any expressions containing SpEL syntax
• Use a sandbox or restricted SpEL evaluation context that disables access to dangerous classes like Runtime and ProcessBuilder
• Deploy the application behind a reverse proxy with request filtering capabilities
• Apply network segmentation to limit the blast radius of potential compromise

# Configuration example: Restrict access to vulnerable endpoint via nginx
location /warm-flow/save-json {
    # Allow only trusted admin IPs
    allow 10.0.0.0/8;
    deny all;
    
    # Additional request filtering
    if ($request_body ~* "(T\(|Runtime|exec\(|ProcessBuilder)") {
        return 403;
    }
}