Critical severity · published Nov 10, 2022
CVE-2022-39036
The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary file and execute arbitrary code to manipulate system or disrupt service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
Agentflow · Flowring
4.0.0.1183.552 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39036
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39036
Vendor Advisory
https://www.flowring.com/2022/09/19/%e7%94%a2%e5%93%81%e6%9b%b4%e6%96%b0agentflow-v4-0%e3%80%81v3-7%e5%a4%be%e6%aa%94%e5%8a%9f%e8%83%bd%e8%b3%87%e5%ae%89%e4%bf%ae%e6%ad%a3/
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-6682-21207-1.html
More from Agentflow
9.8
CVE-2026-2096
Flowring｜Agentflow - Missing Authenticaton
9.8
CVE-2026-2095
Flowring｜Agentflow - Authentication Bypass
9.8
CVE-2025-3709
Flowring Technology Agentflow - Account Lockout Bypass
8.8
CVE-2026-2097
Flowring｜Agentflow - Arbitrary File Upload
8.8
CVE-2022-39038
Agentflow BPM enterprise management system has improper authentication