Executive brief
Flowise, a tool for building LLM applications, contains a vulnerability in how it handles file paths for data storage. An authorized user could exploit this to save data to restricted folders on the server's hard drive. This could lead to the corruption of system files, unauthorized data placement, or potentially allow an attacker to gain further control over the server.
Technical details
A path traversal vulnerability exists in Flowise versions up to 3.0.13 within the Faiss and SimpleStore (LlamaIndex) vector store implementations. The 'basePath' parameter provided by users during document store configuration is passed directly to filesystem write operations (e.g., FaissStore.save and storageContextFromDefaults) without proper sanitization or validation. An authenticated attacker with 'documentStores:upsert-config' permissions can provide a manipulated path (e.g., using '../' sequences) to write vector store data to arbitrary directories. This can result in file overwrites, data exfiltration to network mounts, or remote code execution if files are written to web-accessible or startup directories. The issue is fixed in version 3.1.0.
Affected products
- FlowiseAI flowise <= 3.0.13
- FlowiseAI flowise-components <= 3.0.13
Timeline
- 2026-04-15: disclosed
- 2026-04-16: advisory: GitHub Advisory GHSA-w6v6-49gh-mc9w published
- 2026-04-16: patched: Fixed in version 3.1.0
References
- https://api.github.com/users/tenbbughunters
- https://github.com/tenbbughunters
- https://api.github.com/users/tenbbughunters/gists%7B/gist_id%7D
- https://api.github.com/users/tenbbughunters/repos
- https://avatars.githubusercontent.com/u/152317477?v=4
- https://api.github.com/users/tenbbughunters/events%7B/privacy%7D