High severity · published Feb 10, 2026
CVE-2026-2097
Flowring｜Agentflow - Arbitrary File Upload
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
Agentflow developed by Flowring has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
Agentflow · Flowring
0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2097
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2097
Third Party Advisory
https://www.twcert.org.tw/en/cp-139-10700-3534d-2.html
Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-10699-49c0b-1.html
More from Agentflow
9.8
CVE-2026-2096
Flowring｜Agentflow - Missing Authenticaton
9.8
CVE-2026-2095
Flowring｜Agentflow - Authentication Bypass
9.8
CVE-2025-3709
Flowring Technology Agentflow - Account Lockout Bypass
9.8
CVE-2022-39036
The file upload function of Agentflow BPM has insufficient filtering for special characters in URLs
8.8
CVE-2022-39038
Agentflow BPM enterprise management system has improper authentication