CVE-2025-71332
CVE-2025-71332 · Flowise - SQL Injection in importChatflows API via chatflow.id Parameter
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to be executed, including blind and error-based extraction of data from the credential table.
CVSS 8.5 · Élevée · EPSS 0,5%
- Publication
- Mise à jour
Pile logicielle: node