CVE-2026-52475

Deferred Deferred - Pending Action

Cross Site Scripting in aiflowy <= 2.1.2

Publication date: 2026-07-21

Last updated on: 2026-07-22

Assigner: MITRE

Description

Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-22

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-52475

Affected Vendors & Products

Vendor	Product	Version / Range
aiflowy	aiflowy	to 2.1.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross Site Scripting (XSS) issue in the software aiflowy version 2.1.2 or earlier. It allows a remote attacker to inject malicious scripts via the UploadController.java file, potentially stealing sensitive information from users.

Detection Guidance

To detect this Cross Site Scripting vulnerability in aiflowy <= 2.1.2, inspect the UploadController.java file for improper input validation. Check for user-supplied input being reflected in web responses without proper sanitization. Manually review the file or use static code analysis tools like SonarQube or Checkmarx to identify XSS patterns.

Impact Analysis

If you use aiflowy <= 2.1.2, an attacker could exploit this to steal cookies, session tokens, or other sensitive data from users interacting with the application. This could lead to unauthorized access to accounts or data breaches.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR (General Data Protection Regulation) due to unauthorized access to personal data. For HIPAA (Health Insurance Portability and Accountability Act), it could expose protected health information, risking compliance.

Mitigation Strategies

Immediately update aiflowy to a version higher than 2.1.2 to remove the vulnerability. If updating is not possible, consider disabling the UploadController functionality or restricting network access to the affected component.

Hi! I’m here to help you understand CVE-2026-52475. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70