cve-2025-71334

{
  "cvss": 9.3,
  "datePublished": "2026-07-03T00:00:00Z",
  "dateUpdated": "2026-07-03T00:00:00Z",
  "description": "Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.",
  "dueDate": "",
  "id": "CVE-2025-71334",
  "kev_catalogs": [
    "vulncheck"
  ],
  "knownRansomwareCampaignUse": "Unknown",
  "product": "Flowise",
  "requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
  "severity": "CRITICAL",
  "source": "vulncheck_kev",
  "title": "FlowiseAI Flowise External Control of File Name or Path",
  "vendor": "FlowiseAI"
}