Flowable Engine
Approved changes feed: RSS · Atom
cpe:2.3:a:flowable:flowable-engine:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Flowable (3a0423fc-2259-5450-abf2-d4deacfca5da) |
|---|---|
| Product | Flowable Engine (2afdd8c1-9a27-5e1d-83ca-1160806b321a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-91197 |
vulnerable | 2026-09-16 04:32:55.577884 |
Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
MEDIUM (6.5)
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations with external entities in BPMN files to read arbitrary local files or trigger requests to internal network endpoints when diagram layout is computed.
Published: 2026-09-14T22:10:55.214Z
Updated: 2026-09-24T14:22:14.221Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.