Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2025-71334: Flowise versions 2.2.8 and earlier allow unauthorized file access
CVE-2025-71334
Summary
An attacker can access or write any file on your system without permission by exploiting a weakness in the way Flowise handles file paths. This could potentially allow them to execute malicious code. You should update to Flowise version 3.0.6 or later to fix this issue.
Original title
Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers i...
Original description
Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.
nvd CVSS3.1
9.8
nvd CVSS4.0
9.3
Vulnerability type
CWE-73
- https://github.com/FlowiseAI/Flowise/commit/8bd3de41533de78e4ef6c980e5704a1f9cb7...
- https://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f22...
- https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-q67q-549q-p849
- https://www.vulncheck.com/advisories/flowise-arbitrary-file-access-via-missing-c...
Published: 25 Jun 2026 · Updated: 23 Jul 2026 · First seen: 25 Jun 2026