CVE-2026-96440

Executive Summary

CVE-2026-96440 is a path traversal vulnerability (CWE-22) in the /WebAgenda/download/uploadFile.jsp endpoint of Flowring Agentflow 4.0 builds released before 2023/03/24. An authenticated remote user can supply a manipulated path parameter to cause the application to write uploaded files to arbitrary locations outside the intended upload directory. Successful exploitation breaks the integrity of the underlying filesystem and can enable web shell deployment, configuration tampering, or overwrite of application resources — though no public proof-of-concept or in-the-wild exploitation has been observed to date.

Technical Analysis

The vulnerability is a classic "Improper Limitation of a Pathname to a Restricted Directory," catalogued as CWE-22 (Path Traversal). It resides in the file-upload handling logic reachable through the /WebAgenda/download/uploadFile.jsp endpoint of Flowring Agentflow 4.0. According to the NVD description, the flaw is triggered by the path parameter, which is used to determine the destination directory for an uploaded file. The application fails to properly normalize and constrain this value, so an authenticated user can traverse out of the intended upload directory and cause the server to write the uploaded content to an arbitrary location on the filesystem.

The attack surface is a JSP-based web endpoint that is network-reachable and requires only a low-privilege authenticated session. The core defect class — failure to canonicalize a user-controlled path and validate it against a fixed base directory — is well understood. Effective defenses require resolving the path (e.g., via canonicalization), rejecting absolute paths and traversal sequences, and confirming the final resolved path remains within the permitted directory. The NVD description does not disclose the exact sanitization routine, encoding handling, or parameter parsing logic, and the trailing pre-2023/03/24 build boundary suggests the issue was addressed in a later vendor build, but no vendor advisory text is available to confirm the fix.

The critical nuance is that this is an arbitrary file write, not a read. Write primitives are generally more dangerous than read primitives because they can lead to remote code execution when the write target is a location the web server can execute — for example, a directory that serves compiled or interpreted content. The required authentication reduces the attacker population but does not eliminate risk, since valid low-privilege accounts are common in enterprise deployments.

Exploitation Scenarios

The following chain is inferred from the vulnerability class and the NVD description. No public proof-of-concept exists, and no specific function names, internal parameters, or code patterns are asserted beyond those stated in the description (/WebAgenda/download/uploadFile.jsp, path parameter).

1. Reconnaissance / target identification. The attacker locates an internet- or intranet-exposed Flowring Agentflow 4.0 instance, typically by identifying the Agentflow/WebAgenda web interface. Build fingerprinting is used to determine whether the instance predates the 2023/03/24 boundary, since only those builds are asserted to be affected.

2. Authentication. The attacker obtains or already possesses valid low-privilege credentials. The NVD description explicitly requires an authenticated remote user, so the flaw is not pre-auth. In practice this means credential reuse, a compromised low-privilege account, or a separate authentication-bypass would need to be chained.

3. Path traversal trigger. The attacker sends a crafted upload request to the /WebAgenda/download/uploadFile.jsp endpoint. The path parameter is manipulated with traversal sequences (e.g., ../ sequences or equivalent encoded forms) so that the destination resolves outside the intended upload directory. The exact encoding and traversal syntax accepted by the endpoint is not specified in the available data and would require validation in a controlled lab.

4. Arbitrary file write. Because the server trusts the attacker-supplied destination, the uploaded file is written to the attacker-chosen location. Depending on directory permissions and the deployment topology, this could place attacker-controlled content into web-served or otherwise sensitive directories.

5. Post-exploitation impact. Potential outcomes include web shell deployment (if the write target is executable by the web server), overwriting of application configuration or JSP resources, or staging of further payloads. Actual achievability depends on filesystem permissions and server configuration, which vary by deployment.

Impact Assessment

Business impact: An arbitrary write primitive on a business-process or workflow application server can lead to full compromise of the application, defacement, data tampering, and potential lateral movement into backend systems the application can reach. For Agentflow, which is typically deployed as a workflow/process platform, integrity of uploaded and stored content is central to business trust.

Affected systems: Flowring Agentflow 4.0 builds released before 2023/03/24. Later builds are presumed addressed but are not confirmed by an available advisory.

CVSS subscores (per the intended vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N):

• Attack Vector: Network (AV:N) — the endpoint is remotely reachable.
• Attack Complexity: Low (AC:L) — no special conditions beyond a valid session.
• Privileges Required: Low (PR:L) — a basic authenticated account suffices.
• User Interaction: None (UI:N) — no victim action required.
• Scope: Unchanged (S:U) — impact remains within the vulnerable component's security authority.
• Confidentiality: None (C:N) — the described primitive is write-only.
• Integrity: High (I:H) — arbitrary file write directly undermines data and code integrity.
• Availability: None (A:N) — no direct denial-of-service is described.

The combination of network reachability, low privilege, and high integrity impact makes this a meaningful risk for any organization still running pre-2023/03/24 Agentflow 4.0, even though confidentiality and availability are not directly implicated.

Detection Guidance

Sigma Rule

title: Flowring Agentflow Path Traversal File Upload (CVE-2026-96440)
id: 3f8c1e02-9a4b-4c7d-8e21-7b6a5c0d9f11
status: experimental
description: Detects path traversal attempts against the Agentflow WebAgenda uploadFile.jsp endpoint via the path parameter.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96440
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/WebAgenda/download/uploadFile.jsp'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '..\\'
  condition: selection_endpoint and selection_traversal
fields:
  - c-ip
  - cs-uri-query
  - cs-method
falsepositives:
  - Legitimate applications that encode relative paths in uploads (rare)
level: high

YARA Rule

rule CVE_2026_96440_Agentflow_PathTraversal_Upload
{
    meta:
        description = "Detects traversal-style path values targeting Agentflow WebAgenda uploadFile.jsp"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96440"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"
    strings:
        $ep   = "uploadFile.jsp"
        $p1   = "path=" ascii nocase
        $t1   = "../" ascii
        $t2   = "..%2f" ascii nocase
        $t3   = "..%5c" ascii nocase
        $t4   = "%2e%2e%2f" ascii nocase
    condition:
        $ep and $p1 and any of ($t*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96440 Flowring Agentflow Path Traversal Upload Attempt"; flow:established,to_server; http.uri; content:"/WebAgenda/download/uploadFile.jsp"; http.uri; content:"path="; http.uri; pcre:"/(\.\.\/|\.\.%2f|\.\.%5c|%2e%2e%2f|%2e%2e\/)/i"; classtype:web-application-attack; reference:cve,2026-96440; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-96440; sid:2026964401; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5s
  [ network where http.request.method == "POST" and
      http.request.uri like "*WebAgenda/download/uploadFile.jsp*" and
      http.request.uri like "*path=*" ]
  [ network where http.request.uri like "*..*" and
      http.request.uri regex~ ".*(%2e%2e|\.\.)(%2f|%5c|/|\\\\).*" ]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="*/WebAgenda/download/uploadFile.jsp*" uri_query="*path=*"
| regex uri_query="(?i)(%2e%2e|\.\.)(%2f|%5c|/|\\\\)"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_query) as queries by src_ip, uri_path, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,agentflow,cve-2026-96440,">
  <rule id="2026964" level="12">
    <if_sid>31100</if_sid>
    <match>/WebAgenda/download/uploadFile.jsp</match>
    <regex>path=.*(%2e%2e|\.\.)(%2f|%5c|/|\\)</regex>
    <description>CVE-2026-96440: Flowring Agentflow path traversal upload attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,pci_dss_6.5,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network access to /WebAgenda/download/ endpoints using WAF/ACL rules; whitelist only trusted source ranges.
   • Deploy the detection rules above to alert on traversal sequences in the path parameter.
   • Review and audit all existing accounts; enforce least privilege and remove dormant users to reduce the authenticated attack surface.
   • If functionality permits, disable file upload via the WebAgenda/download/uploadFile.jsp endpoint until a fix is applied.
   • Ensure the upload directory and web-served directories are on separate paths with restrictive filesystem permissions (non-executable upload target).

2. Patch / upgrade steps

   • Upgrade Flowring Agentflow 4.0 to a build released after 2023/03/24, which the version boundary implies contains the fix. Confirm directly with Flowring support, as no vendor advisory is available in tracked sources.
   • After upgrade (or if upgrade is not immediately possible), re-validate sanitization manually in a staging environment.

3. Long-term hardening

   • Canonicalize all user-supplied paths and reject any value that resolves outside a fixed base directory (defense-in-depth against CWE-22).
   • Reject absolute paths and traversal sequences before file operations.
   • Store uploads outside the web root and serve them through a controlled handler.
   • Route uploads through an allowlist of extensions and content-type validation.
   • Monitor for repeated traversal attempts as an indicator of enumeration or exploit development.

References

• NVD — CVE-2026-96440: https://nvd.nist.gov/vuln/detail/CVE-2026-96440
• CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-96440 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Flowring Agentflow product information: https://www.flowring.com/ (vendor support required to confirm the specific fixed build)

No known threat actor campaigns or exploit-in-the-wild evidence for CVE-2026-96440 were identified in available sources. No public proof-of-concept, Nuclei template, or private exploit code is known at the time of writing.