CVE-2026-91197

Flowable's flowable-engine through 8.0.0 fails to disable external entity resolution when parsing deployed BPMN resources in ProcessDiagramLayoutFactory.parseXml(), an XML external entity (XXE) flaw (CWE-611). An attacker who already holds process deployment privileges can upload a BPMN file containing a DOCTYPE declaration with external entities; when the engine computes the diagram layout, those entities are resolved, allowing the attacker to read arbitrary local files on the server or force requests to internal network endpoints (SSRF). Any organization running Flowable up to and including 8.0.0 and allowing BPMN deployment by untrusted or semi-trusted users is affected. The flaw is rated high (CVSS 4.0: 7.1) with network attack vector and low privileges required; no public proof of concept is known, it is not in the CISA KEV catalog, and there is no evidence of exploitation in the wild.

What to do: Restrict BPMN process deployment privileges to trusted users only and audit already-deployed BPMN resources for DOCTYPE or ENTITY declarations. Upgrade to a Flowable release newer than 8.0.0 as soon as a fix ships; in the interim, configure the XML parser used for diagram layout generation to disallow doctype declarations (disallow-doctype-decl=true) or disable diagram generation for untrusted deployments. Review server logs for unexpected outbound requests or anomalous file reads that could indicate exploitation attempts.