p PatchFirst

CVE-2025-71324

CVE-2025-71324 · Flowise - Arbitrary File Read via chatId Parameter

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.

CVSS 8.7 · High · EPSS 1.6% · Public exploit · Fix available

Published
Updated

Stack: node

Affected products and versions

  • flowise

    Versions
    • ≥ 0, < 3.0.6: Affected (semver)
    • 3.0.6: Not affected (semver)

    Update to 3.0.6

  • flowise npm

    Versions
    • 3.0.5
    Affected ranges
    • SEMVER: ≥ 3.0.5, < 3.0.6

    Update to 3.0.6

Original sources

Check your server →