---
id: CVE-2026-91197
title: >-
  Flowable flowable-engine through 8.0.0 contains an XML external entity
  injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails
  to disable external entity resolution when parsing deployed BPMN resources
summary: >-
  Flowable flowable-engine through 8.0.0 contains an XML external entity
  injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails
  to disable external entity resolution when parsing deployed BPMN resources.
  Attackers wit…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-611
vendor: flowable
product: flowable-engine
affected:
  - flowable-engine <= 8.0.0
published: '2026-09-14'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:44:42.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91197'
references:
  - url: 'https://github.com/flowable/flowable-engine'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/flowable/flowable-engine/blob/0779d68e5a3385b74d8acb8bc37901ff54513249/modules/flowable-engine/src/main/java/org/flowable/engine/impl/bpmn/diagram/ProcessDiagramLayoutFactory.java#L101-L118
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/flowable/flowable-engine/blob/0779d68e5a3385b74d8acb8bc37901ff54513249/modules/flowable5-engine/src/main/java/org/activiti/engine/impl/bpmn/diagram/ProcessDiagramLayoutFactory.java#L97-L114
    label: disclosure@vulncheck.com
  - url: 'https://github.com/flowable/flowable-engine/issues/4216'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/flowable-flowable-engine-through-8.0.0-xxe-via-processdiagramlayoutfactory
    label: disclosure@vulncheck.com
  - url: 'https://github.com/flowable/flowable-engine/issues/4216'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00464
epssPercentile: 0.37578
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-16T16:23:08.147708Z'
ingestedAt: '2026-09-14T23:17:06.518Z'
---

## Overview

Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations with external entities in BPMN files to read arbitrary local files or trigger requests to internal network endpoints when diagram layout is computed.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.