A path traversal flaw exists in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 that allows an authenticated user to write files to arbitrary locations outside the intended upload directory. This improper limitation of a pathname (CWE‑22) permits the attacker to place potentially malicious files, including executable code, on the server. As a result, confidentiality, integrity, and possibly availability of the affected system could be compromised if the uploaded files are executed by the application or other users.

The vulnerability affects Flowring Technology Corp’s Agentflow 4.0 product for any release prior to 2023‑03‑24. Specific version numbers are not listed; the issue is tied to the uploadFile.jsp component available in those early releases.

With a CVSS score of 7.1, the flaw presents a high impact potential. The EPSS score is listed as less than 1%, indicating that the probability of observed exploitation is low but not negligible, and the vulnerability is not currently included in the CISA KEV catalog. Exploitation requires remote authenticated access to the vulnerable API, allowing the attacker to control the path parameter to reference directories outside the intended upload folder. If an attacker successfully writes a malicious script or configuration file, subsequent execution could lead to arbitrary code execution or further system compromise.