A vulnerability classified as critical has been found in Shenzhen Dashi Tongzhou Information Technology AgileBPM up to 2.5.0. Affected is the function parseStrByFreeMarker of file /src/main/java/com/dstz/sys/rest/controller/SysToolsController.java. The manipulation argument str leads deserialization. It possible launch attack remotely. exploit disclosed public and may be used.