Executive brief
Flowise, an open-source tool for building LLM applications, contains a critical flaw that allows unauthorized users to write files to the server's filesystem. By sending a specially crafted request, an attacker can overwrite essential system files, such as configuration or package files. This can lead to a complete takeover of the server, allowing the attacker to execute malicious commands or steal sensitive data when the application restarts.
Technical details
A path traversal vulnerability exists in the `/api/v1/document-store/loader/process` endpoint of Flowise. The root cause is the lack of sanitization of the `fileName` parameter within the `storageUtils.ts` component, specifically in functions like `addBase64FilesToStorage`. An unauthenticated attacker can use `../` sequences in the `txtFile` parameter to escape the intended directory and overwrite arbitrary files on the host. A demonstrated exploit involves overwriting `package.json` to modify the application's start scripts, resulting in Remote Code Execution (RCE) when the service is restarted. As of the advisory date, no patched version is specified, though the vulnerability is confirmed in version 1.8.2.
Affected products
- FlowiseAI Flowise <= 1.8.2
Timeline
- 2025-03-14: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: NVD publication date