Tribal1012

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 2.2.8 **Description** An authenticated user can execute arbitrary SQL commands, including blind and error-based data extraction from the credential table, due to insufficient validation of the `id` field in JSON import files. The issue occurs because the `id` value is concatenated unsanitized into a SQL IN clause within the `importChatflows()` function. This affects the '/api/v1/chatflows/importchatflows' endpoint. Additionally, the `importTools()` and `importVariables()` functions are also identified as vulnerable. A separate issue allows a malicious user to include path traversal sequences (e.g., `../`) in the `id` field of a crafted JSON file to potentially access unauthorized paths when the file is imported and accessed. **Recommendations** Update to version 2.2.8 or later. Restrict the format of all chatflow and chat IDs to UUIDs to prevent the injection of arbitrary strings. As a temporary mitigation, restrict access to the '/api/v1/chatflows/importchatflows' endpoint and avoid importing JSON files from untrusted sources.