{"id":"CVE-2025-59527","sourceIdentifier":"security-advisories@github.com","published":"2025-09-22T20:15:39.387","lastModified":"2026-10-11T20:10:00.200","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery (SSRF) vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise server as a proxy to access internal network web services and explore their link structures. This issue has been patched in version 3.0.6."},{"lang":"es","value":"Flowise es una interfaz de usuario de arrastrar y soltar para construir un flujo de modelo de lenguaje grande personalizado. En la versión 3.0.5, fue descubierta una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) en el endpoint /api/v1/fetch-links de la aplicación Flowise. Esta vulnerabilidad permite a un atacante utilizar el servidor Flowise como un proxy para acceder a servicios web de la red interna y explorar sus estructuras de enlaces. Este problema ha sido parcheado en la versión 3.0.6."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"FlowiseAI","product":"Flowise","versions":[{"version":"= 3.0.5","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-09-22T20:25:46.315263Z","id":"CVE-2025-59527","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-918"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:flowiseai:flowise:3.0.5:*:*:*:*:*:*:*","matchCriteriaId":"D5D151AD-7484-4BE3-B42F-7D0279B5E886"}]}]}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/src/utils.ts#L474-L478","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/controllers/fetch-links/index.ts#L6-L24","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/fetch-links/index.ts#L8-L18","source":"security-advisories@github.com","tags":["Product"]},{"url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-hr92-4q35-4j3m","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]}]}