Description
EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files.
Published: 2026-09-30
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Confidentiality breach due to arbitrary file read
Action: Apply patch
AI Analysis

Impact

EasyFlow .NET, a workflow automation product from DigiWin, contains an arbitrary file read flaw. Authenticated remote attackers can exploit the vulnerability to download any system files the application process can access, exposing sensitive data or configuration information.

Affected Systems

The vulnerability affects DigiWin:EasyFlow .NET. Affected product versions are not listed in the available data, so all released versions prior to the patch should be considered at risk.

Risk and Exploitability

The CVSS score of 7.1 indicates a high potential impact when exploited. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. Attackers must have valid credentials and remote access to perform the exploit. Once authenticated, they can read arbitrary files, potentially leading to confidentiality loss and further pivoting within the system.

Generated by OpenCVE AI on September 30, 2026 at 12:00 UTC.

Remediation

Vendor Solution

Update to the patch version released after April 20, 2026.

OpenCVE Recommended Actions

  • Apply the vendor patch released after April 20, 2026 to address the file read flaw
  • Enforce least privilege for user accounts that interact with EasyFlow .NET to limit exposure of file paths
  • Monitor for unusual file read operations and restrict file access permissions as a temporary safeguard

Generated by OpenCVE AI on September 30, 2026 at 12:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Digiwin
Digiwin easyflow .net
Vendors & Products Digiwin
Digiwin easyflow .net

Wed, 30 Sep 2026 09:00:00 +0000

Type Values Removed Values Added
Description EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files.
Title DigiWin｜EasyFlow .NET - Arbitrary File Read
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Digiwin Easyflow .net
cve-icon MITRE

Status: PUBLISHED

Assigner: twcert

Published:

Updated: 2026-09-30T08:32:38.324Z

Reserved: 2026-09-29T08:18:20.347Z

Link: CVE-2026-102457

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-30T09:17:13.650

Modified: 2026-09-30T09:17:13.650

Link: CVE-2026-102457

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T12:15:17Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')