CVE-2025-71338: Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API
Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71338?
CVE-2025-71338 has a severity rating of critical (10).
How do I fix CVE-2025-71338?
To mitigate CVE-2025-71338, sanitize the fileName parameters to prevent path traversal and unauthorized file writes.
What type of vulnerability is CVE-2025-71338?
CVE-2025-71338 is a path traversal vulnerability that allows unauthorized file manipulation.
Who is affected by CVE-2025-71338?
CVE-2025-71338 affects users of the Flowise application that utilizes the document-store API.
What are the potential consequences of exploiting CVE-2025-71338?
Exploiting CVE-2025-71338 can lead to arbitrary file writes and remote code execution, compromising system integrity.