{"id":"EUVD-2025-210340","enisaUuid":"7afc5f37-8f95-3e76-95fd-e9277084a485","description":"Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., \u0027../../../../../tmp\u0027) as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.","datePublished":"Jun 25, 2026, 9:41:05 PM","dateUpdated":"Oct 29, 2026, 9:15:18 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-q67q-549q-p849\nhttps://github.com/FlowiseAI/Flowise/commit/8bd3de41533de78e4ef6c980e5704a1f9cb7ae6f\nhttps://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7\nhttps://www.vulncheck.com/advisories/flowise-arbitrary-file-access-via-missing-chat-flow-id-validation\n","aliases":"CVE-2025-71334\nGHSA-w5r9-j49j-2m55\n","assigner":"VulnCheck","epss":4.36,"enisaIdProduct":[{"id":"972d5fbb-077f-3037-8053-34af66a9a766","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 \u003c3.0.6"}],"enisaIdVendor":[{"id":"0e314298-e066-3751-9bc4-8001ad4fff83","vendor":{"name":"Flowise"}}],"enisaIdVulnerability":[{"id":"437d9533-4e9e-34df-9939-860bee7377f4","vulnerability":{"id":"CVE-2025-71334","description":"Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., \u0027../../../../../tmp\u0027) as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.","datePublished":"Jun 25, 2026, 9:41:05 PM","dateUpdated":"Oct 29, 2026, 9:15:18 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-q67q-549q-p849\nhttps://github.com/FlowiseAI/Flowise/commit/8bd3de41533de78e4ef6c980e5704a1f9cb7ae6f\nhttps://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7\nhttps://www.vulncheck.com/advisories/flowise-arbitrary-file-access-via-missing-chat-flow-id-validation\n","enisa_id":"EUVD-2025-210340\n","assigner":"VulnCheck","epss":4.36,"dataProcessed":"Nov 4, 2026, 7:18:54 AM","vulnerabilityProduct":[{"id":"3e331ad7-12db-369e-9384-a2423a5ec2cf","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 \u003c3.0.6"}],"vulnerabilityVendor":[{"id":"57f57a95-abd7-3cbb-b4c9-4ec476d9955e","vendor":{"name":"Flowise"}}]}},{"id":"6a93c3f5-f3c9-3abe-9a38-86089eedd70a","vulnerability":{"id":"GHSA-w5r9-j49j-2m55","description":"Duplicate Advisory : Flowise has arbitrary file access due to missing chat flow id validation","datePublished":"Jun 26, 2026, 12:32:05 AM","dateUpdated":"Nov 3, 2026, 5:35:33 PM","baseScore":0.0,"references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-q67q-549q-p849\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71334\nhttps://github.com/FlowiseAI/Flowise/commit/8bd3de41533de78e4ef6c980e5704a1f9cb7ae6f\nhttps://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7\nhttps://www.vulncheck.com/advisories/flowise-arbitrary-file-access-via-missing-chat-flow-id-validation\n","enisa_id":"EUVD-2025-210340\n","aliases":"GHSA-w5r9-j49j-2m55\n","epss":0.0,"dataProcessed":"Nov 5, 2026, 5:01:36 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}