{"cvss":7.5,"datePublished":"2026-07-17T00:00:00Z","dateUpdated":"2026-07-17T00:00:00Z","description":"Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName` body parameter. No known patches for this issue are available.","dueDate":"","id":"CVE-2024-36420","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"Flowise","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"FlowiseAI Flowise Improper Neutralization of Special Elements in Output Used by a Downstream Component","vendor":"FlowiseAI"}