CVE-2026-96440: Flowring Agentflow Path Traversal Flaw

CVE-2026-96440 Overview

CVE-2026-96440 is a path traversal vulnerability in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 versions released before 2023/03/24. The flaw allows remote authenticated users to write files to arbitrary locations outside the intended upload directory by manipulating the path parameter. The weakness is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory. Successful exploitation can result in unauthorized file writes across the server file system, enabling attackers to overwrite configuration files, plant web shells, or tamper with application binaries.

Critical Impact
Authenticated attackers can write arbitrary files outside the upload directory, leading to integrity compromise of the Agentflow application server.

Affected Products

Flowring Agentflow 4.0 (versions released before 2023/03/24)
/WebAgenda/download/uploadFile.jsp endpoint
Deployments exposing the WebAgenda module to authenticated users

Discovery Timeline

2026-09-29 - CVE-2026-96440 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-96440

Vulnerability Analysis

The vulnerability resides in the uploadFile.jsp handler within the Agentflow WebAgenda module. The endpoint accepts a path parameter that specifies the destination for uploaded content. The application fails to normalize or validate this parameter against a restricted base directory. An authenticated attacker can supply directory traversal sequences such as ../ to escape the intended upload root and write files anywhere the application server process has write permission.

Because Agentflow is a business process management platform, compromised servers often hold workflow data, credentials, and integration secrets. Writing to web-accessible directories converts this flaw into a code execution primitive when the attacker plants a JSP file that the servlet container will execute.

Root Cause

The root cause is missing canonicalization and allowlist checks on the user-controlled path parameter. The handler concatenates the parameter into a file system path without rejecting traversal sequences or verifying the resolved path resides within the intended upload directory.

Attack Vector

Exploitation requires network access to the WebAgenda endpoint and valid application credentials. The attacker issues a crafted POST request to /WebAgenda/download/uploadFile.jsp with a path value containing traversal sequences and an attacker-controlled file body. See the Zuso AI CVE Advisory for additional technical context.

No verified public exploit code is available at the time of publication. The vulnerability is described in prose because no sanitized proof-of-concept has been released.

Detection Methods for CVE-2026-96440

Indicators of Compromise

Requests to /WebAgenda/download/uploadFile.jsp containing ../, ..\, or URL-encoded traversal sequences (%2e%2e%2f) in the path parameter
New or modified JSP, WAR, or configuration files under the Agentflow web application root that do not match deployment artifacts
Unexpected file writes to system directories owned by the application server user

Detection Strategies

Inspect web server and reverse proxy logs for POST requests to the vulnerable endpoint with suspicious path parameter values
Deploy web application firewall (WAF) rules that block path traversal patterns targeting uploadFile.jsp
Baseline the Agentflow web root and alert on unauthorized file creation using file integrity monitoring

Monitoring Recommendations

Enable verbose access logging on the Agentflow application server and forward logs to a central SIEM for correlation
Alert on authenticated sessions performing sequential uploads that reference varying path values
Monitor process creation events under the servlet container process for anomalous child processes indicating web shell execution

How to Mitigate CVE-2026-96440

Immediate Actions Required

Upgrade Flowring Agentflow 4.0 to a build released on or after 2023/03/24
Restrict network access to the /WebAgenda/ path to trusted administrative networks
Rotate credentials for accounts that had access to the WebAgenda module during the exposure window
Audit the application web root and file system for unauthorized files written by the servlet container user

Patch Information

Flowring addressed the vulnerability in Agentflow 4.0 builds released after 2023/03/24. Contact Flowring support to obtain the patched build, and consult the Zuso AI CVE Advisory for vendor guidance and version details.

Workarounds

Deploy WAF rules that reject requests to uploadFile.jsp containing traversal sequences or absolute paths in the path parameter
Enforce least-privilege on the servlet container account so writes outside the upload directory are denied by the operating system
Disable or firewall the WebAgenda endpoint if the functionality is not required in production

bash

# Example ModSecurity rule blocking path traversal on the vulnerable endpoint
SecRule REQUEST_URI "@contains /WebAgenda/download/uploadFile.jsp" \
  "id:1026960,phase:2,deny,status:403,log,msg:'CVE-2026-96440 path traversal attempt',\
  chain"
  SecRule ARGS:path "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" "t:none,t:urlDecodeUni"