CRITICAL🇵🇱 Wersja polska

CVE-2025-71334

CVSS 9.3v4.0pub. 2026-06-25upd. 2026-07-01

Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The application does not verify whether the chatflowId and chatId parameters have the required UUID or numeric format during file operations. An attacker can pass a value containing a path traversal sequence (e.g., '../../../../../tmp') as the chatflow identifier. By exploiting the /api/v1/chatflows endpoint (addBase64FilesToStorage function), it is possible to write arbitrary files anywhere in the file system. The /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (streamStorageFile function) allow reading arbitrary files. The attack requires no authentication.

Impact

An unauthenticated attacker can read arbitrary files from the server (e.g., secrets, keys, configurations) and write arbitrary files, which can consequently lead to remote code execution (RCE) on the server hosting Flowise.

Mitigation & patch

Flowise should be updated to version 3.0.6 or later. Fixes are available in commits 8bd3de41533de78e4ef6c980e5704a1f9cb7ae6f and c2b830f279e454e8b758da441016b2234f220ac7 in the FlowiseAI/Flowise repository on GitHub.

Who is affected

Flowise in version 2.2.8 and earlier (fix introduced in version 3.0.6)

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X