CVE-2025-71324: Flowise - Arbitrary File Read via chatId Parameter
Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.0.6 - Compensating control
Restrict network access to the vulnerable endpoints /api/v1/get-upload-file and /api/v1/openai-assistants-file/download so unauthenticated attackers cannot reach them.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71324?
CVE-2025-71324 has a severity rating of high with a score of 8.7.
How do I fix CVE-2025-71324?
To fix CVE-2025-71324, upgrade Flowise to version 3.0.6 or later, where the vulnerability is addressed.
What systems are affected by CVE-2025-71324?
CVE-2025-71324 affects Flowise software versions prior to 3.0.6.
What type of vulnerability is CVE-2025-71324?
CVE-2025-71324 is an arbitrary file read vulnerability that arises from improper validation of the chatId parameter.
How can CVE-2025-71324 be exploited?
CVE-2025-71324 can be exploited by crafting requests to the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints with a malicious chatId value.