← Database

CVE-2022-25894

CRITICAL CVSS: 9.8 Published: 2023-01-26 Modified: 2026-06-17

Description

All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression(expression).evaluate(context); functionality, due to improper user input validation.

Affected Platforms

Uflo Project Uflo

Weakness Type

CWE-94, CWE-94, CWE-94

References