Back to overview

CVE-2025-71334

CRITICAL
9.8
CVSS 3.1
Description
Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.

Metadata

CVE ID
CVE-2025-71334
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-06-20 01:48 UTC
Published
2026-06-25 21:41 UTC
Last updated
2026-06-25 21:41 UTC
Primary CWE
CWE-73
External Control of File Name or Path
Vendor / Product
Flowise / Flowise
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products (1)
VendorProductPlatformVersions
Flowise Flowise — 0 < 3.0.6, 3.0.6
Weakness (CWE)
CWESourceDescription
CWE-73 cna External Control of File Name or Path
CVSS scores (2)
ScoreSeverityVersionSourceVector
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References (4)
Back to overview