CVE-2025-71334: Flowise - Arbitrary File Access via Missing Chat Flow ID Validation
Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Flowiseto a version that resolves this vulnerability.Fixed in 3.0.6 - Configuration
Ensure the chatflowId and chatId parameters used in /api/v1/chatflows (via addBase64FilesToStorage) and in /api/v1/get-upload-file and /api/v1/openai-assistants-file/download (via streamStorageFile) are validated to be UUIDs or numbers so path traversal values like '../../../../../tmp' are rejected.
Flowise API endpoints chatflowId/chatId validation = must be UUIDs or numbers
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71334?
The severity of CVE-2025-71334 is rated as critical with a score of 9.3.
How do I fix CVE-2025-71334?
To fix CVE-2025-71334, update your Flowise software to version 3.0.6 or later.
What does CVE-2025-71334 exploit?
CVE-2025-71334 exploits a vulnerability in Flowise related to arbitrary file access due to missing validation of parameters.
What versions are affected by CVE-2025-71334?
CVE-2025-71334 affects Flowise versions 2.2.8 and earlier.
What impact does CVE-2025-71334 have?
CVE-2025-71334 allows an attacker to access arbitrary files on the server, potentially leading to data disclosure.