Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability was determined in opencc JFlow up to 20260129. This affects the function Imp_Done of the file src/main/java/bp/wf/httphandler/WF_Admin_AttrFlow.java of the component Workflow Engine. This manipulation of the argument File causes xml external entity reference. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-2536 XML External Entity Injection in opencc JFlow Workflow Engine via Argument Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2536
Post summary
CVE-2026-2536 is an XML External Entity injection flaw in opencc JFlow Workflow Engine, triggered via argument manipulation, with no PoC, exploit, or patch details mentioned.