CVE-2026-96431: Flowring Agentflow File Upload RCE Flaw

CVE-2026-96431 Overview

CVE-2026-96431 is an unrestricted file upload vulnerability in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0. The endpoint accepts dangerous file types without validation, allowing authenticated attackers to upload malicious server-executable files. Successful exploitation grants arbitrary system command execution on the underlying host. The flaw affects Flowring Agentflow 4.0 versions released before 2023/03/24 and is tracked under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact

Remote authenticated attackers can execute arbitrary system commands on the Agentflow server, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

• Flowring Agentflow 4.0 (versions released before 2023/03/24)
• /WebAgenda/download/uploadFile.jsp API endpoint
• Deployments exposing the WebAgenda module to authenticated users

Discovery Timeline

• 2026-09-29 - CVE-2026-96431 published to the National Vulnerability Database (NVD)
• 2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-96431

Vulnerability Analysis

The vulnerability resides in the uploadFile.jsp handler within the WebAgenda module of Flowring Agentflow 4.0. The endpoint accepts uploaded files without validating file extension, MIME type, or content. Authenticated users can therefore submit executable server-side content such as JSP web shells. Once written to a web-accessible directory, the attacker requests the uploaded file and the application server executes it, yielding arbitrary command execution in the context of the Agentflow process.

Because the attack requires only low-privilege authentication and no user interaction, any account with WebAgenda access becomes a viable entry point. Command execution occurs in the service account running the Java application server, which frequently holds broad filesystem and network privileges.

Root Cause

The root cause is missing server-side validation of uploaded content in uploadFile.jsp. The endpoint fails to enforce an allow-list of safe extensions, does not verify magic bytes, and stores files under a directory that the servlet container will execute. This combination transforms a file upload primitive into remote code execution.

Attack Vector

An authenticated remote attacker sends a crafted HTTP POST request to /WebAgenda/download/uploadFile.jsp containing a JSP payload disguised as a legitimate document. After the file is stored in the deployed web root, the attacker issues a follow-up GET request to invoke the uploaded resource. The application server compiles and executes the JSP, running attacker-supplied operating system commands. See the Zuso AI CVE Advisory for additional technical context.

Detection Methods for CVE-2026-96431

Indicators of Compromise

• Unexpected .jsp, .jspx, or .war files written under the WebAgenda upload directory
• HTTP POST requests to /WebAgenda/download/uploadFile.jsp followed by GET requests to newly created files
• Java application server processes (java.exe, tomcat) spawning shell interpreters such as cmd.exe, powershell.exe, or /bin/sh
• Outbound network connections initiated by the Agentflow service to unfamiliar hosts

Detection Strategies

• Inspect web server access logs for authenticated requests to uploadFile.jsp correlated with subsequent requests to uncommon filenames
• Monitor filesystem writes in the WebAgenda deployment directory for executable content types
• Alert on child process creation from the Agentflow Java runtime, which should not typically fork command shells

Monitoring Recommendations

• Enable audit logging on the WebAgenda upload endpoint and forward events to a centralized SIEM
• Baseline normal upload behavior and alert on files exceeding expected extensions or sizes
• Deploy file integrity monitoring on the servlet container webapps directory to detect unauthorized JSP additions

How to Mitigate CVE-2026-96431

Immediate Actions Required

• Upgrade Flowring Agentflow 4.0 to the fixed release dated 2023/03/24 or later
• Restrict network access to the /WebAgenda/download/uploadFile.jsp endpoint to trusted management networks
• Review authentication logs and rotate credentials for any account with WebAgenda access
• Audit the WebAgenda upload directory for unauthorized files and remove any web shells

Patch Information

Flowring released a fixed version of Agentflow 4.0 on 2023/03/24. Administrators should apply the vendor-supplied patch and confirm the uploadFile.jsp handler enforces file type validation. Refer to the Zuso AI CVE Advisory for vendor coordination details.

Workarounds

• Block external access to /WebAgenda/download/uploadFile.jsp at the reverse proxy or web application firewall
• Configure the servlet container to prevent execution of JSP files inside the upload directory
• Enforce strict file extension allow-lists and MIME type checks via a WAF policy until patching is complete
• Run the Agentflow application server under a least-privilege service account to limit post-exploitation impact

# Example nginx reverse proxy rule to block the vulnerable endpoint
location ~* /WebAgenda/download/uploadFile\.jsp$ {
    deny all;
    return 403;
}