Executive brief
Flowise, an open-source tool for building LLM applications, contains a vulnerability that allows authorized users to write files to any location on the server's hard drive. By connecting the application to a malicious storage server, an attacker can bypass security restrictions to overwrite critical system files or configuration data. This could lead to a complete service outage, theft of sensitive credentials, or potentially full control over the server.
Technical details
A path traversal vulnerability exists in the S3 Directory and S3 File document loaders of Flowise. The application uses `path.join()` to combine a temporary directory path with S3 object keys without sanitizing traversal sequences like `../`. An authenticated attacker with `documentStores:preview-process` permissions can configure a custom `serverUrl` pointing to a malicious S3-compatible endpoint. When the loader processes objects from this endpoint, it writes files to unintended locations on the host filesystem. Because the cleanup routine only deletes the initial temporary directory, the traversed files persist. This can be leveraged for arbitrary file write, data destruction, or remote code execution if the service account has permissions to modify executable files. This is fixed in version 3.1.3.
Affected products
- FlowiseAI flowise <= 3.1.2
- FlowiseAI flowise-components <= 3.1.2
Timeline
- 2026-07-29: disclosed
- 2026-08-04: advisory
- 2026-08-04: patched: Fixed in version 3.1.3