CVE-2026-52097

MediumCVSS 6.8

Published: 10/09/2026(UTC)Updated: 10/09/2026(UTC)Translated: 10/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.41%

35th percentile - higher than 35% of all known CVEs

Summary

An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, and localPathRegex (common_patterns.dart) components.

Risk Assessment

A remote attacker could execute arbitrary code within the AppFlowy application context, potentially leading to system compromise or theft of user data.

Recommendation

Update AppFlowy to a version newer than 0.11.8 as soon as a fix is available, and restrict the ability to open untrusted links and files within the application.

Other vulnerabilities in AppFlowy

CVE-2026-16007High
AppFlowy's qcuiknote feature is affected by a SQL injection vulnerability. Authenticated users with access to the feature can inject arbitrary SQL to exfiltrate data in the underlying SQL database.

Original NVD description (English source)

An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, localPathRegex (common_patterns.dart) components

Vulnerability data from NVD (NIST) · CISA KEV · EPSS