CVE-2025-71334

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-71334
Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/FlowiseAI/Flowise/commit/8bd3de41533de78e4ef6c980e5704a1f9cb7ae6f Patch
https://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7 Patch
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-q67q-549q-p849 Exploit Vendor Advisory
https://www.vulncheck.com/advisories/flowise-arbitrary-file-access-via-missing-chat-flow-id-validation Third Party Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-q67q-549q-p849 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*
History

29 Oct 2026, 21:17

Type Values Removed Values Added
Summary (en) Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution. (en) Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.

30 Sep 2026, 16:10

Type Values Removed Values Added
Summary
  • (es) Flowise antes de la versión 3.0.6 (versiones afectadas 2.2.8 y anteriores) contiene una vulnerabilidad de acceso arbitrario a archivos debido a la falta de validación de que los parámetros chatflowId y chatId son UUIDs o números en las operaciones de manejo de archivos. Al proporcionar un valor de path-traversal (por ejemplo, '.. / .. / .. / .. / ../tmp') como el ID del chatflow, un atacante no autenticado puede usar el endpoint /api/v1/chatflows (a través de addBase64FilesToStorage) para escribir archivos arbitrarios, y los endpoints /api/v1/get-upload-file y /api/v1/openai-assistants-file/download (a través de streamStorageFile) para leer archivos arbitrarios. La escritura arbitraria de archivos puede conducir a la ejecución remota de código.
Information

Published : 2026-06-25 22:16

Updated : 2026-10-29 21:17

NVD link : CVE-2025-71334

Mitre link : CVE-2025-71334

CVE.ORG link : CVE-2025-71334

JSON object : View

Products Affected

flowiseai

  • flowise
CWE
CWE-73

External Control of File Name or Path