{"id":"CVE-2022-25894","aliases":["EUVD-2023-0410","GHSA-8m9f-c5p9-wqch"],"status":"published","title":"Remote Code Execution in com.bstek.uflo:uflo-core","description":"All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression(expression).evaluate(context); functionality, due to improper user input validation.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02685,"percentile":0.85969,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2023-01-25T05:00:03Z","modified":"2026-06-17T04:34:27Z","affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.bstek.uflo:uflo-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.5"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.bstek.uflo:uflo-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.5"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5"]}],"products":[{"vendor":"uflo_project","product":"uflo"}],"references":[{"url":"https://security.snyk.io/vuln/SNYK-JAVA-COMBSTEKUFLO-3091112","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/youseries/uflo/blob/b3e198bc6523e5a6ba69edd84ba10e05a3b78726/uflo-core/src/main/java/com/bstek/uflo/expr/impl/ExpressionContextImpl.java%23L126","tags":["x_transferred","Broken Link"]},{"url":"https://fmyyy1.github.io/2022/10/23/uflo2rce/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25894","tags":["advisory"]},{"url":"https://github.com/youseries/uflo/blob/b3e198bc6523e5a6ba69edd84ba10e05a3b78726/uflo-core/src/main/java/com/bstek/uflo/expr/impl/ExpressionContextImpl.java#L126","tags":["web"]},{"url":"https://fmyyy1.github.io/2022/10/23/uflo2rce","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8m9f-c5p9-wqch"}],"sources":{"cve":[{"id":"CVE-2022-25894","description":"All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression(expression).evaluate(context); functionality, due to improper user input validation.","status":"published","published":"2023-01-25T05:00:03.528Z","modified":"2025-04-01T14:53:31.776Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"critical","assessor":"cna"}],"cwes":["CWE-94","CWE-94"],"updated_at":"2026-11-02T14:34:28.374916Z"}],"euvd":[{"id":"EUVD-2023-0410","description":"All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression(expression).evaluate(context); functionality, due to improper user input validation.","status":"published","published":"2023-01-25T05:00:03Z","modified":"2025-04-01T14:53:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P","level":"critical"}],"updated_at":"2026-11-02T20:52:45.844316Z"}],"ghsa":[{"id":"GHSA-8m9f-c5p9-wqch","title":"Remote Code Execution in com.bstek.uflo:uflo-core","description":"All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression(expression).evaluate(context); functionality, due to improper user input validation.","status":"published","published":"2023-01-26T21:30:25Z","modified":"2025-04-01T22:57:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:38:37.325334Z"}],"nvd":[{"id":"CVE-2022-25894","description":"All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression(expression).evaluate(context); functionality, due to improper user input validation.","status":"published","published":"2023-01-26T21:15:31.607Z","modified":"2026-06-17T04:34:27.35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:07:35.561816Z"}],"osv":[{"id":"GHSA-8m9f-c5p9-wqch","title":"Remote Code Execution in com.bstek.uflo:uflo-core","description":"All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression(expression).evaluate(context); functionality, due to improper user input validation.","status":"published","published":"2023-01-26T21:30:25Z","modified":"2025-04-01T22:59:58.329089Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:42.437513Z"}]}}