Executive brief
AntFlow is a workflow automation platform used to manage business processes and tasks. An unfiltered JUEL expression evaluation vulnerability in the ActivitiTest.java component allows remote attackers to execute arbitrary commands on the server without authentication, potentially giving them full control of the affected system and access to all data it processes.
Technical details
AntFlow V2.0.0 contains a JUEL expression injection vulnerability in ActivitiTest.java where user-supplied input in the "el" parameter is passed directly to JuelEvaluator without any validation or sanitization. An attacker can send a specially crafted request to the /admin-api/activiti/evalExpression endpoint containing arbitrary JUEL expressions, which are then evaluated server-side, allowing command execution with the privileges of the application server. The vulnerability is network-accessible and requires no authentication or user interaction. A patch status has not been specified in available advisories.
Affected products
- AntFlow AntFlow V2.0.0
Timeline
- 2026-08-26: disclosed
- 2026-08-26: advisory