Executive brief
aiflowy, a data management and workflow platform, contains a security flaw that could allow unauthorized individuals to access sensitive information stored in its database. By sending specially crafted requests to the system's data center component, an attacker can bypass security controls to view private data. This could lead to the exposure of confidential business records or customer information.
Technical details
A SQL injection vulnerability exists in aiflowy versions up to and including 2.1.2. The flaw is located within the getPageData method of the DatacenterQuery.java file, accessible via the /api/v1/datacenterTable/getPageData endpoint. The application fails to properly sanitize user-supplied input before incorporating it into database queries. A remote, unauthenticated attacker can exploit this by sending malicious SQL commands to the affected endpoint, potentially leading to unauthorized data extraction from the backend database. As of the advisory date, users are advised to monitor for patches from the vendor.
Affected products
- aiflowy aiflowy <= 2.1.2
Timeline
- 2026-07-21: disclosed: Initial disclosure via GitHub and NVD publication.