Skip to content
OpenAdvisories

Product · flowable

flowable-engine

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-91197

    Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory

    Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment p…

    flowable flowable-engine