CVE-2025-71324

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.6

Description An arbitrary file read issue exists where the chatId parameter in the '/api/v1/get-upload-file' and '/api/v1/openai-assistants-file/download' endpoints is not validated. This value is passed to the streamStorageFile() function, where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check. This allows path traversal, enabling unauthenticated attackers to read sensitive files, such as '/root/.flowise/database.sqlite', which can expose all database content in the default configuration.

Recommendations Update to version 3.0.6 or later. Avoid using the chatId parameter in the '/api/v1/get-upload-file' and '/api/v1/openai-assistants-file/download' endpoints until the update is applied.