CVE-2026-56273

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0

Description Path traversal occurs in the Faiss and SimpleStore vector store implementations. The issue arises when the system accepts unsanitized basePath parameters from authenticated users. Attackers possessing valid API tokens can write vector store data to arbitrary locations on the filesystem, which may lead to data exfiltration or code execution.

Recommendations Update to version 3.1.0 or later. Restrict the use of the basePath parameter in Faiss and SimpleStore implementations until the update is applied.