CVE-2026-6125

A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

• CWE-74
• CWE-94

• https://gitee.com/dromara/warm-flow/
• https://gitee.com/dromara/warm-flow/issues/IHURVQ
• https://vuldb.com/submit/793322
• https://vuldb.com/vuln/356989
• https://vuldb.com/vuln/356989/cti

Published

Apr 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61244Vulnerability in the PeopleSoft Enterprise FIN Manufacturing…9.1
• CVE-2026-61245Vulnerability in the PeopleSoft Enterprise FIN Manufacturing…9.8
• CVE-2026-61246Vulnerability in the Oracle Platform Security for Java produ…8.8
• CVE-2026-61247Vulnerability in the Oracle Workflow product of Oracle E-Bus…4.8
• CVE-2026-61248Vulnerability in the Oracle Internet Directory product of Or…9.9
• CVE-2026-61249Vulnerability in the Oracle Learning Management product of O…6.5
• CVE-2026-61250Vulnerability in the Oracle Payroll product of Oracle E-Busi…6.5
• CVE-2026-61251Vulnerability in the HRMS (Australia) product of Oracle E-Bu…6.5
• CVE-2026-61252Vulnerability in the Oracle HRMS (Hong Kong) product of Orac…5.4
• CVE-2026-61253Vulnerability in the Oracle HRMS (Japanese) product of Oracl…5.4
• CVE-2026-61254Vulnerability in the Oracle HRMS (Republic of Korea) product…5.4
• CVE-2026-61255Vulnerability in the Oracle HRMS (New Zealand) product of Or…5.4