This vulnerability (CWE-22) in Agentflow 4.0 allows authenticated remote attackers to perform path traversal via the path parameter in the /WebAgenda/download/uploadFile.jsp endpoint. By exploiting this, attackers can write files to arbitrary locations outside the restricted upload directory. The issue affects versions prior to the fix date of 2023/03/24. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high impact on integrity.

Successful exploitation allows an authenticated attacker to write files to arbitrary locations on the server filesystem outside the intended upload directory. This can lead to unauthorized file modification or placement, potentially enabling further attacks or system compromise. The vulnerability does not require user interaction and has a high impact on data integrity.

No official patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable API endpoint to trusted users only and monitor for suspicious activity involving file uploads.