PT-2026-8312 · Unknown · Opencc Jflow

Maoqiu · Publicado 2026-02-16 · Atualizado 2026-02-16 · CVE-2026-2536

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions opencc JFlow versions prior to 20260129

Description A flaw exists in opencc JFlow’s Workflow Engine component, specifically within the Imp Done function of the src/main/java/bp/wf/httphandler/WF Admin AttrFlow.java file. This issue stems from the manipulation of the File argument, leading to XML External Entity (XXE) reference. The attack can be initiated remotely. The details of this issue have been publicly disclosed, and the project has been notified but has not yet responded.

Recommendations Update opencc JFlow to a version later than 20260129. As a temporary workaround, restrict access to the WF Admin AttrFlow.java file. Avoid using the File argument in the Imp Done function until the issue is resolved.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-610

CWE-611

Identificadores relacionados

CVE-2026-2536

Produtos afetados

Opencc Jflow

Referências · 10

• 🔥 https://gitee.com/opencc/JFlow/issues/IDN7GT · Exploit
• https://twitter.com/VulmonFeeds/status/2023285700565647794 · Publicação no Twitter
• https://vuldb.com/?id.346124 · Nota
• https://vuldb.com/?submit.748807 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-2536 · Nota de Segurança
• https://gitee.com/opencc/JFlow · Nota
• https://vuldb.com/?submit.748808 · Nota
• https://vuldb.com/?ctiid.346124 · Nota
• https://t.me/cveNotify/152086 · Publicação no Telegram
• https://t.me/CVEtracker/44790 · Publicação no Telegram