CVE-2025-71338

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-71338
Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.2.7-patch.1
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948 Exploit Vendor Advisory
https://www.vulncheck.com/advisories/flowise-arbitrary-file-write-to-remote-code-execution-via-document-store-api Third Party Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*
History

30 Sep 2026, 16:10

Type Values Removed Values Added
Summary
  • (es) Flowise contiene una vulnerabilidad de salto de ruta en el endpoint /api/v1/document-store/loader/process que permite a atacantes no autenticados escribir archivos arbitrarios en el sistema de archivos. Los atacantes pueden explotar parámetros fileName no saneados con secuencias ../ para sobrescribir archivos críticos como package.json y lograr la ejecución remota de código cuando la aplicación se reinicia.

17 Sep 2026, 19:16

Type Values Removed Values Added
References
  • () https://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.2.7-patch.1 -
Summary (en) Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts. (en) Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.
Information

Published : 2026-06-25 22:16

Updated : 2026-10-12 21:10

NVD link : CVE-2025-71338

Mitre link : CVE-2025-71338

CVE.ORG link : CVE-2025-71338

JSON object : View

Products Affected

flowiseai

  • flowise
CWE
CWE-73

External Control of File Name or Path