Executive brief
Flowise is an open-source low-code platform for building AI applications. The S3 Directory document loader contains a path-traversal vulnerability that allows authenticated users with a specific role to write files to arbitrary locations on the server. An attacker can exploit this to overwrite application data, configuration files, or secrets, and potentially achieve remote code execution if the Flowise process has write access to executable or startup files.
Technical details
The vulnerability is a path-traversal flaw (CWE-22) in the S3 Directory document loader. When processing S3 object keys, the loader uses path.join(tempDir, key) without validating that the key contains traversal sequences (e.g., ../). The resolved path is then used to create directories and write files with no validation that the destination remains within the intended temporary directory. An authenticated attacker with the documentStores:preview-process role can craft S3 object keys containing path traversal sequences and point the loader to an attacker-controlled S3-compatible endpoint (e.g., MinIO) to write arbitrary files to any path writable by the Flowise process. The temporary directory cleanup removes only the original temp directory, leaving escaped files persisted on disk. A related variant exists in the S3File loader. No user interaction is required beyond initial authentication.
Affected products
- FlowiseAI Flowise <=3.1.2
- FlowiseAI flowise-components <=3.1.2
Timeline
- 2026-08-04: disclosed
- 2026-08-04: patched: Version 3.1.3 released with fix