Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）

Improper  Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp  API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated  users to write files to arbitrary locations outside the intended upload  directory via the path parameter.

‍

Update Agentflow 4.0 to 2023/03/24.

‍