{"cvss":9.3,"datePublished":"2026-07-03T00:00:00Z","dateUpdated":"2026-07-03T00:00:00Z","description":"Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.","dueDate":"","id":"CVE-2025-71334","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"Flowise","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"CRITICAL","source":"vulncheck_kev","title":"FlowiseAI Flowise External Control of File Name or Path","vendor":"FlowiseAI"}