Executive brief
Flowise, an open-source tool for building LLM applications, contains a security flaw that allows unauthorized users to read sensitive files from the server. By exploiting this vulnerability, an attacker can download the application's internal database, which contains sensitive information such as API keys and configuration data. This could lead to a full takeover of the application and access to connected third-party services.
Technical details
An arbitrary file read vulnerability exists in Flowise due to improper validation of the 'chatId' parameter in the '/api/v1/get-upload-file' and '/api/v1/openai-assistants-file/download' endpoints. While the application performs a containment check against the storage directory, a fallback mechanism in the 'streamStorageFile()' function constructs a file path without the 'orgId' and evaluates it after the initial security check. This allows an unauthenticated attacker to use path traversal sequences (e.g., '../../') to escape the intended directory. Attackers can leak a required 'chatflowId' via a separate error-based disclosure in the '/api/v1/vector/upsert/' endpoint and subsequently read sensitive files like 'database.sqlite'. The issue is fixed in version 3.0.6.
Affected products
- FlowiseAI Flowise < 3.0.6
Timeline
- 2025-07-22: other: Vulnerability discovered/tested by researcher
- 2025-09-13: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: NVD publication date