CVE-2025-11898

—

CVSS 4.0

8.7 high

EPSS

<1%p53

Published

Oct 17, 2025 (Oct 17, 2025)

Modified

Jun 17, 2026

Description

Agentflow developed by Flowring has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.

Weakness: CWE-23
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.