p PatchFirst

CVE-2025-71332

CVE-2025-71332 · Flowise - SQL Injection in importChatflows API via chatflow.id Parameter

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to be executed, including blind and error-based extraction of data from the credential table.

CVSS 8.5 · High · EPSS 0.5%

Published
Updated

Stack: node

Affected products and versions

  • flowise

    Versions
    • ≥ 0, ≤ 2.2.7: Affected (semver)

    No fix published

  • flowise npm

    Affected ranges
    • SEMVER: ≤ 2.2.7

    No fix published

Original sources

Check your server →