{"id":"EUVD-2025-210343","enisaUuid":"69a60a5e-7c2f-3e78-bbb3-1c630b5822b0","description":"Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.","datePublished":"Jun 25, 2026, 9:41:07 PM","dateUpdated":"Sep 17, 2026, 6:57:19 PM","baseScore":10.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.2.7-patch.1\nhttps://www.vulncheck.com/advisories/flowise-arbitrary-file-write-to-remote-code-execution-via-document-store-api\n","aliases":"CVE-2025-71338\nGHSA-c3hj-m5hq-59xw\n","assigner":"VulnCheck","epss":1.16,"enisaIdProduct":[{"id":"6f468dcc-c6a2-3732-ac0e-0fbcfc691332","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 ≤2.2.7"}],"enisaIdVendor":[{"id":"35f3481e-5f7f-3220-9e4f-b0d25866db4c","vendor":{"name":"Flowise"}}],"enisaIdVulnerability":[{"id":"1984ceaa-59c2-31ed-98eb-002834443167","vulnerability":{"id":"CVE-2025-71338","description":"Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.","datePublished":"Jun 25, 2026, 9:41:07 PM","dateUpdated":"Sep 17, 2026, 6:57:19 PM","status":"PUBLISHED","baseScore":10.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.2.7-patch.1\nhttps://www.vulncheck.com/advisories/flowise-arbitrary-file-write-to-remote-code-execution-via-document-store-api\n","enisa_id":"EUVD-2025-210343\n","assigner":"VulnCheck","epss":1.16,"dataProcessed":"Nov 4, 2026, 7:18:54 AM","vulnerabilityProduct":[{"id":"0777d107-085e-30b3-a680-22d5085ce5dd","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 ≤2.2.7"}],"vulnerabilityVendor":[{"id":"6f52a3d6-539c-3a82-bd7c-35288b6d61af","vendor":{"name":"Flowise"}}]}},{"id":"8d4a6aaf-bce1-3fb0-a75f-362bbbf8d7c5","vulnerability":{"id":"GHSA-c3hj-m5hq-59xw","description":"Duplicate Advisory : Flowise allows arbitrary file write to RCE","datePublished":"Jun 26, 2026, 12:32:05 AM","dateUpdated":"Nov 3, 2026, 5:36:48 PM","baseScore":0.0,"references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71338\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.2.7-patch.1\nhttps://www.vulncheck.com/advisories/flowise-arbitrary-file-write-to-remote-code-execution-via-document-store-api\n","enisa_id":"EUVD-2025-210343\n","aliases":"GHSA-c3hj-m5hq-59xw\n","epss":0.0,"dataProcessed":"Nov 5, 2026, 5:01:36 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}