CVE-2025-71338
Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 10
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- EPSS probability
- 0.94%
- CWE
- CWE-73
- Published
- 2026-06-25
- Last modified
- 2026-06-26
Affected products
- Flowise Flowise
Weakness type
Related vulnerabilities
- CVE-2026-50148 — Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write
- CVE-2026-20358 — Cisco Crosswork Security Hardening Release: August 2026
- CVE-2026-11526 — GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in _make_filehandle
- CVE-2026-67429 — Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)
- CVE-2026-48750 — Incus has an arbitrary file write on host via `exec-output` symlink in crafted image
- CVE-2026-9559 — A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files dur
- CVE-2026-63343 — Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
- CVE-2026-48753 — Incus has an arbitrary file write via path traversal in S3 multipart upload