CVE-2026-91197: Flowable Engine XXE Vulnerability

CVE-2026-91197 Overview

CVE-2026-91197 is an XML External Entity (XXE) injection vulnerability affecting Flowable flowable-engine through version 8.0.0. The flaw resides in the ProcessDiagramLayoutFactory.parseXml() method, which fails to disable external entity resolution when parsing deployed Business Process Model and Notation (BPMN) resources. An attacker with process deployment privileges can embed DOCTYPE declarations referencing external entities within BPMN files. When the diagram layout is computed, the parser resolves those entities, enabling arbitrary local file disclosure or Server-Side Request Forgery (SSRF) against internal network endpoints. The weakness is classified under CWE-611: Improper Restriction of XML External Entity Reference.

Critical Impact
Authenticated attackers with BPMN deployment rights can read arbitrary files from the Flowable host and pivot into internal network services via SSRF.

Affected Products

Flowable flowable-engine versions up to and including 8.0.0
Flowable 5-engine module containing the legacy org.activiti.engine.impl.bpmn.diagram.ProcessDiagramLayoutFactory
Any application embedding the vulnerable Flowable engine for BPMN process execution

Discovery Timeline

2026-09-14 - CVE-2026-91197 published to the National Vulnerability Database (NVD)
2026-09-16 - CVE record last modified in NVD

Technical Details for CVE-2026-91197

Vulnerability Analysis

The defect lives in Flowable's diagram layout pipeline. When a deployed BPMN 2.0 XML resource is retrieved to compute diagram coordinates, ProcessDiagramLayoutFactory.parseXml() constructs a DocumentBuilderFactory without disabling external entity resolution, DTD loading, or the FEATURE_SECURE_PROCESSING control. The parser therefore honors DOCTYPE declarations embedded by the deployer. Because BPMN files are treated as trusted internal content, no additional sanitization is performed prior to parsing.

Exploitation requires the authenticated privilege to deploy BPMN process definitions. Once a malicious BPMN payload is deployed and the diagram layout endpoint is invoked, the underlying XML parser dereferences external entities, returning file contents in error output or triggering outbound HTTP requests. Refer to the ProcessDiagramLayoutFactory source snippet and the VulnCheck advisory for the exact code path.

Root Cause

The DocumentBuilderFactory instance used by parseXml() retains Java's insecure defaults. Neither setFeature("http://apache.org/xml/features/disallow-doctype-decl", true) nor setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true) is applied, and setExpandEntityReferences(false) is not called. This permits inline <!ENTITY> definitions that resolve SYSTEM URIs at parse time.

Attack Vector

Attack traffic originates over the network from an authenticated user holding process deployment rights. The adversary uploads a crafted BPMN 2.0 file containing an XXE payload, then triggers the diagram layout API. The parser resolves the external entity, returning local file content (for example, /etc/passwd or Flowable configuration files containing database credentials) or forcing the server to issue HTTP requests to internal-only endpoints such as cloud metadata services. See Flowable issue #4216 for maintainer discussion.

A canonical XXE payload embedded in a BPMN definition uses a DOCTYPE block declaring an external entity that references file:/// or http://internal-host/ URIs, followed by an entity reference inside a BPMN element attribute or text node. Refer to the vendor references for concrete payload structure.

Detection Methods for CVE-2026-91197

Indicators of Compromise

BPMN deployments containing <!DOCTYPE declarations or <!ENTITY definitions, which are not part of standard BPMN 2.0 schemas
Outbound HTTP or DNS requests from the Flowable application host to unexpected external or cloud metadata destinations (for example, 169.254.169.254)
Application logs showing XML parser errors referencing SYSTEM identifiers, file://, or unreachable URIs during diagram layout requests
Unexpected file read activity by the Flowable JVM process targeting sensitive paths such as /etc/passwd, /proc/self/environ, or application configuration files

Detection Strategies

Inspect stored BPMN resources in the Flowable database (ACT_GE_BYTEARRAY) for DOCTYPE or ENTITY tokens using content scanning queries
Deploy a web application firewall (WAF) rule that blocks BPMN uploads containing DTD declarations or external entity references
Correlate diagram layout API calls (/process-definition/{id}/diagram-layout) with subsequent egress traffic from the application server

Monitoring Recommendations

Alert on any egress connection initiated by the Flowable JVM to non-approved hosts, especially link-local metadata endpoints
Enable audit logging for all BPMN deployment events, including the deploying user, source IP, and resource hash
Forward XML parser exception stack traces to a centralized log platform and alert on SAXParseException events referencing external DTDs during process rendering

How to Mitigate CVE-2026-91197

Immediate Actions Required

Restrict BPMN deployment privileges to a minimal set of trusted administrators and revoke deployment rights from general application users
Block or filter inbound BPMN uploads that contain <!DOCTYPE or <!ENTITY declarations at the reverse proxy or API gateway
Disable or firewall the diagram layout endpoint if it is not required by production workflows
Audit historical BPMN deployments for embedded DTDs and remove any suspicious process definitions

Patch Information

At publication, no fixed release is referenced in the NVD entry. Monitor the Flowable Engine GitHub repository and issue #4216 for an official patch. Once available, upgrade flowable-engine and the flowable5-engine module to the fixed version. Both ProcessDiagramLayoutFactory implementations, including the Activiti-derived variant, require remediation.

Workarounds

Apply a runtime DocumentBuilderFactory hardening wrapper via a Java agent or subclass that forces secure parsing features on all XML parsers used by the engine
Run the Flowable process engine in a network-segmented environment with strict egress firewall rules that deny access to internal services and cloud metadata endpoints
Enforce read-only file system mounts and drop unnecessary file permissions for the Flowable service account to limit XXE-based file disclosure

bash

# Example egress restriction using iptables to block cloud metadata access
iptables -A OUTPUT -m owner --uid-owner flowable -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner flowable -d 127.0.0.0/8 -p tcp ! --dport 5432 -j DROP

# Recommended DocumentBuilderFactory hardening (for custom builds)
# dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
# dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
# dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
# dbf.setFeature(javax.xml.XMLConstants.FEATURE_SECURE_PROCESSING, true);
# dbf.setExpandEntityReferences(false);