CVE-2025-71338: Flowise - Arbitrary File Write to Remote Code Execution via document-store API
Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71338?
CVE-2025-71338 has a severity rating of critical (10).
How do I fix CVE-2025-71338?
To mitigate CVE-2025-71338, sanitize the fileName parameters to prevent path traversal and unauthorized file writes.
What type of vulnerability is CVE-2025-71338?
CVE-2025-71338 is a path traversal vulnerability that allows unauthorized file manipulation.
Who is affected by CVE-2025-71338?
CVE-2025-71338 affects users of the Flowise application that utilizes the document-store API.
What are the potential consequences of exploiting CVE-2025-71338?
Exploiting CVE-2025-71338 can lead to arbitrary file writes and remote code execution, compromising system integrity.