Vulnerability Description
Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations with external entities in BPMN files to read arbitrary local files or trigger requests to internal network endpoints when diagram layout is computed.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/flowable/flowable-engine
- https://github.com/flowable/flowable-engine/blob/0779d68e5a3385b74d8acb8bc37901f
- https://github.com/flowable/flowable-engine/blob/0779d68e5a3385b74d8acb8bc37901f
- https://github.com/flowable/flowable-engine/issues/4216
- https://www.vulncheck.com/advisories/flowable-flowable-engine-through-8.0.0-xxe-
- https://github.com/flowable/flowable-engine/issues/4216
FAQ
What is CVE-2026-91197?
CVE-2026-91197 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing d...
How severe is CVE-2026-91197?
CVE-2026-91197 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-91197?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.