CVE-2025-71338

Name of the Vulnerable Software and Affected Versions Flowise (affected versions not specified)

Description An unauthenticated path traversal issue exists in the '/api/v1/document-store/loader/process' endpoint. This flaw allows attackers to write arbitrary files to the filesystem by using unsanitized fileName parameters containing ../ sequences. By overwriting critical files such as package.json, an attacker can achieve remote code execution upon application restart. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.