{"id":"EUVD-2025-29247","enisaUuid":"4745a520-ad8a-3232-a493-fddd249a0646","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery (SSRF) vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise server as a proxy to access internal network web services and explore their link structures. This issue has been patched in version 3.0.6.","datePublished":"Sep 22, 2025, 7:48:42 PM","dateUpdated":"Sep 22, 2025, 8:25:56 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-hr92-4q35-4j3m\nhttps://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/src/utils.ts#L474-L478\nhttps://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/controllers/fetch-links/index.ts#L6-L24\nhttps://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/fetch-links/index.ts#L8-L18\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6\n","aliases":"CVE-2025-59527\nGHSA-hr92-4q35-4j3m\n","assigner":"GitHub_M","epss":5.2,"enisaIdProduct":[{"id":"9c656590-4c7c-3a1d-bb72-36095e173f08","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003d 3.0.5"}],"enisaIdVendor":[{"id":"c42eb0e7-8762-3dde-ab9b-d07dab102134","vendor":{"name":"FlowiseAI"}}],"enisaIdVulnerability":[{"id":"5e94e042-f540-353b-90fb-9269feb347b4","vulnerability":{"id":"CVE-2025-59527","description":"Flowise is a drag \u0026 drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery (SSRF) vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise server as a proxy to access internal network web services and explore their link structures. This issue has been patched in version 3.0.6.","datePublished":"Sep 22, 2025, 7:48:42 PM","dateUpdated":"Sep 22, 2025, 8:25:56 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-hr92-4q35-4j3m\nhttps://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/src/utils.ts#L474-L478\nhttps://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/controllers/fetch-links/index.ts#L6-L24\nhttps://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/fetch-links/index.ts#L8-L18\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6\n","enisa_id":"EUVD-2025-29247\n","assigner":"GitHub_M","epss":5.2,"dataProcessed":"Oct 27, 2026, 7:14:22 AM","vulnerabilityProduct":[{"id":"31411b76-ee17-3a10-bd04-d8f7328f5168","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003d 3.0.5"},{"id":"9b704fd3-6211-419a-84bf-eb38f9142a59","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"\u003d 3.0.5"}],"vulnerabilityVendor":[{"id":"09ceaf31-bfbc-358d-841b-0b4ca60e87a8","vendor":{"name":"FlowiseAI"}}]}},{"id":"87cd836a-fce3-3907-ab25-7469ea562f7d","vulnerability":{"id":"GHSA-hr92-4q35-4j3m","description":"FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability","datePublished":"Sep 15, 2025, 7:53:46 PM","dateUpdated":"Sep 22, 2025, 9:58:31 PM","baseScore":0.0,"references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-hr92-4q35-4j3m\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-59527\nhttps://github.com/FlowiseAI/Flowise\nhttps://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/src/utils.ts#L474-L478\nhttps://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/controllers/fetch-links/index.ts#L6-L24\nhttps://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/fetch-links/index.ts#L8-L18\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6\n","enisa_id":"EUVD-2025-29247\n","aliases":"CVE-2025-59527\nGHSA-hr92-4q35-4j3m\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:12:55 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}