CVE-2026-1126

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1126", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-01-17T18:20:05.336Z", "datePublished": "2026-01-18T16:32:09.728Z", "dateUpdated": "2026-02-23T08:39:44.515Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:39:44.515Z"}, "title": "lwj flow SVG File FormResource.java uploadFile unrestricted upload", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-434", "lang": "en", "description": "Unrestricted Upload"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "lwj", "product": "flow", "versions": [{"version": "a3d2fe8133db9d3b50fda4f66f68634640344641", "status": "affected"}], "modules": ["SVG File Handler"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in lwj flow up to a3d2fe8133db9d3b50fda4f66f68634640344641. This affects the function uploadFile of the file \\flow-master\\flow-front-rest\\src\\main\\java\\com\\dragon\\flow\\web\\resource\\flow\\FormResource.java of the component SVG File Handler. The manipulation of the argument File leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-01-17T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-01-17T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-01-18T23:57:20.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "MaoQiu (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.341718", "name": "VDB-341718 | lwj flow SVG File FormResource.java uploadFile unrestricted upload", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.341718", "name": "VDB-341718 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.735122", "name": "Submit #735122 | https://gitee.com/lwj/flow flowable 1.0 Arbitrary File Upload", "tags": ["third-party-advisory"]}, {"url": "https://gitee.com/lwj/flow/issues/IDIQSE", "tags": ["exploit", "issue-tracking"]}, {"url": "https://gitee.com/lwj/flow/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T16:41:03.839575Z", "id": "CVE-2026-1126", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T16:41:09.641Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1126", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-20T16:41:03.839575Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T16:41:06.664Z"}}], "cna": {"title": "lwj flow SVG File FormResource.java uploadFile unrestricted upload", "credits": [{"lang": "en", "type": "reporter", "value": "MaoQiu (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "lwj", "modules": ["SVG File Handler"], "product": "flow", "versions": [{"status": "affected", "version": "a3d2fe8133db9d3b50fda4f66f68634640344641"}]}], "timeline": [{"lang": "en", "time": "2026-01-17T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-01-17T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-01-18T23:57:20.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.341718", "name": "VDB-341718 | lwj flow SVG File FormResource.java uploadFile unrestricted upload", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.341718", "name": "VDB-341718 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.735122", "name": "Submit #735122 | https://gitee.com/lwj/flow flowable 1.0 Arbitrary File Upload", "tags": ["third-party-advisory"]}, {"url": "https://gitee.com/lwj/flow/issues/IDIQSE", "tags": ["exploit", "issue-tracking"]}, {"url": "https://gitee.com/lwj/flow/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in lwj flow up to a3d2fe8133db9d3b50fda4f66f68634640344641. This affects the function uploadFile of the file \\flow-master\\flow-front-rest\\src\\main\\java\\com\\dragon\\flow\\web\\resource\\flow\\FormResource.java of the component SVG File Handler. The manipulation of the argument File leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "Unrestricted Upload"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T08:39:44.515Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1126", "state": "PUBLISHED", "dateUpdated": "2026-02-23T08:39:44.515Z", "dateReserved": "2026-01-17T18:20:05.336Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-01-18T16:32:09.728Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["SVG File Handler"], "product": "flow", "vendor": "lwj", "versions": [{"status": "affected", "version": "a3d2fe8133db9d3b50fda4f66f68634640344641"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in lwj flow up to a3d2fe8133db9d3b50fda4f66f68634640344641. This affects the function uploadFile of the file \\flow-master\\flow-front-rest\\src\\main\\java\\com\\dragon\\flow\\web\\resource\\flow\\FormResource.java of the component SVG File Handler. The manipulation of the argument File leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad de seguridad en lwj flow hasta a3d2fe8133db9d3b50fda4f66f68634640344641. Esto afecta a la funci\u00f3n uploadFile del archivo \\flow-master\\flow-front-rest\\src\\main\\java\\com\\dragon\\flow\\web\\resource\\flow\\FormResource.java del componente SVG File Handler. La manipulaci\u00f3n del argumento File conduce a una carga sin restricciones. El ataque puede llevarse a cabo de forma remota. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. Este producto adopta una estrategia de lanzamiento continuo para mantener la entrega continua. Por lo tanto, los detalles de la versi\u00f3n para las versiones afectadas o actualizadas no pueden especificarse. Se inform\u00f3 al proyecto del problema con antelaci\u00f3n a trav\u00e9s de un informe de incidencias, pero a\u00fan no ha respondido."}], "id": "CVE-2026-1126", "lastModified": "2026-06-17T10:15:08.800", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1126", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T16:41:03.839575Z", "version": "2.0.3"}}]}, "published": "2026-01-18T17:15:49.713", "references": [{"source": "cna@vuldb.com", "url": "https://gitee.com/lwj/flow/"}, {"source": "cna@vuldb.com", "url": "https://gitee.com/lwj/flow/issues/IDIQSE"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.341718"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.341718"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.735122"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-434"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T05:26:20.825880+00:00", "value": {"mitigation_remediation": ["Apply any vendor\u2011released patch or newer version as soon as it becomes available.", "Enforce strict server\u2011side validation to allow only whitelisted file types and size limits for uploads.", "If the SVG upload feature is not required, disable or restrict it in the application configuration.", "Consider network segmentation or firewall rules to limit public exposure of the upload endpoint to trusted networks."], "summary": {"action": "Apply Patch", "impact": "Unrestricted Remote File Upload"}, "threat_synthesis": {"affected_systems": "This issue affects the lwj Flow application, a web\u2011based workflow platform. The flaw exists in all releases up to commit a3d2fe8133db9d3b50fda4f66f68634640344641, and due to the project\u2019s rolling\u2011release model, any version built after that commit may also be impacted until a patch is provided. Users should assume that no version post\u2011commit is safe without an official fix. The vendor, listed as lwj, has not yet issued a response or update.", "description_and_impact": "The vulnerability lies in the uploadFile method of FormResource.java in the SVG File Handler of lwj Flow. An attacker can send a crafted File argument that bypasses validation, allowing upload of any file type to the server. This unrestricted upload can be exploited remotely, potentially enabling the delivery of malicious code or other files that compromise the integrity and confidentiality of the system. The flaw arises from improper access control (CWE\u2011284) and the lack of file type restrictions (CWE\u2011434).", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity vulnerability. EPSS is reported as less than 1%, suggesting a low probability of active exploitation. The vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. Attackers can exercise the flaw remotely via the uploadFile endpoint. While the immediate risk is moderate, the lack of an available patch and the remote nature of the attack vector may elevate concern for systems that accept untrusted input."}}}}, "created": "2026-01-19T09:19:04.824172+00:00", "updated": "2026-04-18T05:30:25.847093+00:00", "vendors": ["lwj", "lwj$PRODUCT$flow"]}