Rpie9

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.0.6 **Description** An issue exists due to missing validation ensuring that the `chatflowId` and `chatId` parameters are UUIDs or numbers during file handling operations. An unauthenticated attacker can use path-traversal values to perform arbitrary file access. Specifically, the '/api/v1/chatflows' endpoint (via the `addBase64FilesToStorage()` function) can be used to write arbitrary files, while the '/api/v1/get-upload-file' and '/api/v1/openai-assistants-file/download' endpoints (via the `streamStorageFile()` function) can be used to read arbitrary files. Arbitrary file write may lead to remote code execution. **Recommendations** Update to version 3.0.6 or later.