CVE-2025-71338

Flowiseai · Published June 25, 2026

9.8

CVSS v3.1

CRITICAL

Patch availableGet patch

Description

Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.

Affected Products

Flowise <= 3.1.3

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H