CVE-2026-91197CWE-611xxe

CVE-2026-91197

Medium · published September 15, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
39.2
In the wild
Unconfirmed
What it is

Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations with external entities in BPMN files to read arbitrary local files or trigger requests to internal network endpoints when diagram layout is computed.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00464 · 39.2th percentile
Weakness
CWE-611 · Improper Restriction of XML External Entity Reference
Published
2026-09-15T03:19Z
References (6)
https://github.com/flowable/flowable-engine · [email protected]https://github.com/flowable/flowable-engine/blob/0779d68e5a3385b74d8acb8bc37901ff54513249/modules/flowable-engine/src/main/java/org/flowable/engine/impl/bpmn/diagram/ProcessDiagramLayoutFactory.java#L101-L118 · [email protected]https://github.com/flowable/flowable-engine/blob/0779d68e5a3385b74d8acb8bc37901ff54513249/modules/flowable5-engine/src/main/java/org/activiti/engine/impl/bpmn/diagram/ProcessDiagramLayoutFactory.java#L97-L114 · [email protected]https://github.com/flowable/flowable-engine/issues/4216 · [email protected]https://www.vulncheck.com/advisories/flowable-flowable-engine-through-8.0.0-xxe-via-processdiagramlayoutfactory · [email protected]https://github.com/flowable/flowable-engine/issues/4216 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 22:10Z
    Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
    cvelistv5