CVE-2026-6125
MEDIUM
NVD
CVSS Score
6.3
Severity
MEDIUM
Published
Apr 12, 2026
Vendor
unknown
Description
A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.