CVE-2025-71334

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.6

Description An issue exists due to missing validation ensuring that the chatflowId and chatId parameters are UUIDs or numbers during file handling operations. An unauthenticated attacker can use path-traversal values to perform arbitrary file access. Specifically, the '/api/v1/chatflows' endpoint (via the addBase64FilesToStorage() function) can be used to write arbitrary files, while the '/api/v1/get-upload-file' and '/api/v1/openai-assistants-file/download' endpoints (via the streamStorageFile() function) can be used to read arbitrary files. Arbitrary file write may lead to remote code execution.

Recommendations Update to version 3.0.6 or later.