CVE-2026-110185

Bit Flows image helper can include local PHP files through webhook input

Bit Apps / bitpressadmin · Bit Flows AI agent automation ImageHelper

First documented disclosure · Review checkpoint

Summary

A configured webhook flow can expose local file inclusion through image conversion.

Severity and exploitation evidence

Medium · 5.9/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources do not establish malicious exploitation or a confirmed victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Mapped imageToBase64 input reaches file inclusion without adequate path restriction.

Conditions required

An administrator-created webhook flow maps request input to ImageHelper; the webhook has no bearer secret or IP allowlist. Code execution additionally depends on an includable PHP payload.

Potential impact

Sensitive-file access or execution of existing PHP code; arbitrary uploaded-code execution requires a suitable upload path.

Affected versions and configurations

All versions through 1.31.0.

Fix and mitigation status

1.32.0.

Practical next steps

Upgrade; authenticate webhooks, restrict callers and constrain file paths.

Operating lesson

Apply file and network boundaries inside automation nodes as well as at entry points.

Evidence and limits

The October 18 maintainer changelog describes the image helper escaping the uploads folder. Detailed Wordfence disclosure is October 27, CNA publication October 28. CVSS 3.1 5.9 rates confidentiality impact; do not replace it with an inferred RCE score.

Sources