Executive brief
Flowable's workflow engine contains a vulnerability in its BPMN diagram processing that fails to disable external entity resolution. Attackers with process deployment privileges can embed malicious XML declarations in BPMN files to read sensitive local files or trigger requests to internal network systems, potentially exposing configuration data or enabling lateral movement within corporate networks.
Technical details
The vulnerability is an XML External Entity (XXE) injection in ProcessDiagramLayoutFactory.parseXml() that processes deployed BPMN resources. The vulnerable component does not disable external entity resolution when parsing XML, allowing attackers to include DOCTYPE declarations with external entity references in BPMN files. An attacker with process deployment privileges can exploit this to read arbitrary local files or initiate SSRF attacks against internal endpoints when diagram layout is computed. The root cause is insecure XML parsing configuration lacking XXE mitigation features.
Affected products
- Flowable flowable-engine through 8.0.0
Timeline
- 2026-09-14: disclosed