CVE-2026-96440

The vulnerability allows remote authenticated users to exploit a path traversal flaw in the /WebAgenda/download/uploadFile.jsp API of Flowring Agentflow 4.0, enabling them to write files to arbitrary locations outside the designated upload directory. This could lead to unauthorized file access or manipulation, posing a significant risk to the integrity and confidentiality of the system. Organizations using affected versions should prioritize remediation to mitigate potential data breaches or system compromise.