PT-2026-8312 · Unknown · Opencc Jflow

Maoqiu · Published 2026-02-16 · Updated 2026-02-16 · CVE-2026-2536

Positive Technologies · (AI Summary)

CVSS v2.0

6.5

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions opencc JFlow versions prior to 20260129

Description A flaw exists in opencc JFlow’s Workflow Engine component, specifically within the

Imp Done

function of the

src/main/java/bp/wf/httphandler/WF Admin AttrFlow.java

file. This issue stems from the manipulation of the

File

argument, leading to XML External Entity (XXE) reference. The attack can be initiated remotely. The details of this issue have been publicly disclosed, and the project has been notified but has not yet responded.

Recommendations Update opencc JFlow to a version later than 20260129. As a temporary workaround, restrict access to the

WF Admin AttrFlow.java

file. Avoid using the

File

argument in the

Imp Done

function until the issue is resolved.

Exploit

Fix

XXE

Weakness Enumeration

CWE-610

CWE-611

Related Identifiers

CVE-2026-2536

Affected Products

Opencc Jflow

References · 9

• 🔥 https://gitee.com/opencc/JFlow/issues/IDN7GT · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2536 · Security Note
• https://vuldb.com/?ctiid.346124 · Note
• https://vuldb.com/?submit.748807 · Note
• https://twitter.com/VulmonFeeds/status/2023285700565647794 · Twitter Post
• https://vuldb.com/?submit.748808 · Note
• https://vuldb.com/?id.346124 · Note
• https://t.me/cveNotify/152086 · Telegram Post
• https://gitee.com/opencc/JFlow · Note