Executive brief
Flowise is a low-code platform for building AI agent workflows that allows users to define automation tasks using a visual interface. The WriteFileTool component fails to validate file paths, allowing authenticated users to write arbitrary files anywhere on the server filesystem. This could lead to remote command execution by overwriting system configuration files, SSH keys, or application startup scripts.
Technical details
The WriteFileTool in Flowise (packages/components/nodes/tools/WriteFile/WriteFile.ts) implements a file-writing function that accepts a user-supplied file_path parameter without validation or sandboxing checks. Authenticated attackers can exploit this to write files to arbitrary locations on the filesystem. Common attack vectors include writing SSH public keys to ~/.ssh/authorized_keys for remote access, modifying /etc/ld.so.preload for library hijacking, or overwriting package.json startup commands. The vulnerability requires authentication (user registration) but operates over the network with no additional user interaction. Patches are available in Flowise 3.0.8 and later.
Affected products
- Flowise Flowise <=3.0.5
Timeline
- 2025-10-09: disclosed: Advisory GHSA-jv9m-vf54-chjj published
- 2025-10: patched: Fix available in Flowise 3.0.8