The vulnerability lies in the uploadFile method of FormResource.java in the SVG File Handler of lwj Flow. An attacker can send a crafted File argument that bypasses validation, allowing upload of any file type to the server. This unrestricted upload can be exploited remotely, potentially enabling the delivery of malicious code or other files that compromise the integrity and confidentiality of the system. The flaw arises from improper access control (CWE‑284) and the lack of file type restrictions (CWE‑434).

This issue affects the lwj Flow application, a web‑based workflow platform. The flaw exists in all releases up to commit a3d2fe8133db9d3b50fda4f66f68634640344641, and due to the project’s rolling‑release model, any version built after that commit may also be impacted until a patch is provided. Users should assume that no version post‑commit is safe without an official fix. The vendor, listed as lwj, has not yet issued a response or update.

The CVSS score of 5.3 indicates a moderate severity vulnerability. EPSS is reported as less than 1%, suggesting a low probability of active exploitation. The vulnerability is not in the CISA Known Exploited Vulnerabilities catalog. Attackers can exercise the flaw remotely via the uploadFile endpoint. While the immediate risk is moderate, the lack of an available patch and the remote nature of the attack vector may elevate concern for systems that accept untrusted input.