PT-2026-8312 · Unknown · Opencc Jflow

Maoqiu · Published 2026-02-16 · Updated 2026-02-16 · CVE-2026-2536

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions opencc JFlow versions prior to 20260129

Description A flaw exists in opencc JFlow’s Workflow Engine component, specifically within the Imp Done function of the src/main/java/bp/wf/httphandler/WF Admin AttrFlow.java file. This issue stems from the manipulation of the File argument, leading to XML External Entity (XXE) reference. The attack can be initiated remotely. The details of this issue have been publicly disclosed, and the project has been notified but has not yet responded.

Recommendations Update opencc JFlow to a version later than 20260129. As a temporary workaround, restrict access to the WF Admin AttrFlow.java file. Avoid using the File argument in the Imp Done function until the issue is resolved.

Exploit

Fix

XXE

Weakness Enumeration

CWE-610

CWE-611

Related Identifiers

CVE-2026-2536

Affected Products

Opencc Jflow

References · 10

• 🔥 https://gitee.com/opencc/JFlow/issues/IDN7GT · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2536 · Security Note
• https://twitter.com/VulmonFeeds/status/2023285700565647794 · Twitter Post
• https://vuldb.com/?id.346124 · Note
• https://vuldb.com/?submit.748807 · Note
• https://gitee.com/opencc/JFlow · Note
• https://vuldb.com/?submit.748808 · Note
• https://vuldb.com/?ctiid.346124 · Note
• https://t.me/cveNotify/152086 · Telegram Post
• https://t.me/CVEtracker/44790 · Telegram Post