{"id":"EUVD-2025-210340","revision":"78c8b87cf9164ac0a02654c1c9d45030","records":[{"revision":"78c8b87cf9164ac0a02654c1c9d45030","observedAt":"2026-10-27T23:57:57.991+00:00","statement":{"source":"euvd","id":"EUVD-2025-210340","aliases":["CVE-2025-71334","GHSA-w5r9-j49j-2m55"],"title":"Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a …","description":"Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":9.3,"severity":null}],"references":["https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-q67q-549q-p849","https://github.com/FlowiseAI/Flowise/commit/8bd3de41533de78e4ef6c980e5704a1f9cb7ae6f","https://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7","https://www.vulncheck.com/advisories/flowise-arbitrary-file-access-via-missing-chat-flow-id-validation"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-210340","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 25, 2026, 9:41:05 PM","dateUpdated":"Jun 26, 2026, 10:39:31 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-210340","identifiers":["EUVD-2025-210340","CVE-2025-71334","GHSA-w5r9-j49j-2m55"]},"retained":false,"historicalAffected":[]}],"coverage":[]}