p PatchFirst

CVE-2025-61913

CVE-2025-61913 · Flowise is vulnerable to arbitrary file read, arbitrary file write

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability.

CVSS 10.0 · Critical · EPSS 13.0% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • flowise

    Versions
    • < 3.0.8: Affected

    No fix published

  • flowise npm

    Affected ranges
    • SEMVER: < 3.0.8

    Update to 3.0.8

  • flowise-components npm

    Affected ranges
    • SEMVER: < 3.0.8

    Update to 3.0.8

Original sources

Check your server →