Unrestricted upload of a file with a dangerous type to the "/WebAgenda/download/uploadFile.jsp" API endpoint in Flowring Agentflow 4.0 allows a remote authenticated user to execute arbitrary system commands on the hosting server. The flaw is a classic file‑upload vulnerability (CWE‑434) that bypasses any validation on the file type, leading to direct code execution. Attackers can obtain the same privileges as the authenticated user, allowing full compromise of the affected system.

The vulnerability is present in Flowring Technology Corp’s Agentflow 4.0 product, for all releases before March 24 2023. Any deployment of this version prior to that date is impacted; newer releases are presumed to contain a fix.

The CVSS score of 9.3 places this issue in the high severity category, indicating a full compromise is possible. The EPSS score of less than 1% suggests limited current exploitation activity, but the vulnerability remains valuable once the patch is available. It is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be logged in to the application, but once authenticated, the attacker can upload a crafted file that will be executed by the server, resulting in full command execution.