CVE-2026-6125: Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection

Description

A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 23% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

WA

warm-flow · Dromara

1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4 · source: vendor