Description
A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Published: 2026-04-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Code Injection
Action: Immediate Patch
AI Analysis

Impact

A flaw in Dromara warm-flow up to version 1.8.4 allows attackers to inject code through the SpelHelper.parseExpression function used in the Workflow Definition Handler. By manipulating the listenerPath, skipCondition, or permissionFlag parameters, an attacker can execute arbitrary code. The vulnerability is exploitable remotely, and the attack code has already been released to the public.

Affected Systems

The affected product is warm-flow from Dromara. Any installation using version 1.8.4 or earlier is vulnerable.

Risk and Exploitability

The CVSS score is 5.3, indicating a moderate risk level. EPSS data is not available, but the vulnerability is not listed in the CISA KEV catalog. Since the flaw is exploitable from remote sources and public exploit code exists, the likelihood of exploitation is significant. Organizations should treat this as a high priority when deploying or maintaining warm-flow on their systems.

Generated by OpenCVE AI on April 12, 2026 at 11:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Dromara warm-flow to version 1.8.5 or later.
  • If upgrading is not immediately possible, restrict external access to the /warm-flow/save-json endpoint and ensure strict authentication and authorization controls are in place.
  • Validate or sanitize all inputs to listenerPath, skipCondition, and permissionFlag before passing them to SpelHelper.parseExpression.
  • Monitor application logs for anomalous code execution patterns and enforce an incident response plan if suspicious activity is detected.

Generated by OpenCVE AI on April 12, 2026 at 11:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-822v-8w6h-5jxp Warm-Flow has a SpEL Expression Injection in SpelHelper.parseExpression
History

Mon, 13 Apr 2026 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 13 Apr 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Dromara
Dromara warm-flow
Vendors & Products Dromara
Dromara warm-flow

Sun, 12 Apr 2026 10:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Title Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection
Weaknesses CWE-74
CWE-94
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Dromara Warm-flow
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-04-13T17:47:46.421Z

Reserved: 2026-04-11T20:19:59.389Z

Link: CVE-2026-6125

cve-icon Vulnrichment

Updated: 2026-04-13T17:47:33.256Z

cve-icon NVD

Status : Deferred

Published: 2026-04-12T10:16:01.277

Modified: 2026-04-29T01:00:01.613

Link: CVE-2026-6125

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-13T12:56:06Z

Weaknesses