CVE-2025-71332: Flowise - SQL Injection in importChatflows API via chatflow.id Parameter
Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to be executed, including blind and error-based extraction of data from the credential table.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71332?
CVE-2025-71332 has a medium severity rating of 6.5.
How do I fix CVE-2025-71332?
To fix CVE-2025-71332, update Flowise to version 2.2.8 or later, which addresses the SQL injection vulnerability.
What type of vulnerability is CVE-2025-71332?
CVE-2025-71332 is a SQL injection vulnerability affecting the importChatflows API.
Who is affected by CVE-2025-71332?
Authenticated users of the Flowise application can exploit the vulnerability in versions prior to 2.2.8.
What can attackers do with CVE-2025-71332?
Attackers can execute arbitrary SQL commands through a crafted JSON import file, compromising the database.