CVE-2025-71324
published 2026-06-25CVE-2025-71324: Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and…
PriorityP180high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.38%
70.0th percentile
Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| flowise | flowise | < 3.0.6 | 3.0.6 |
| flowiseai | flowise | < 3.0.6 | 3.0.6 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints.
ghsa_unreviewed·2026-06-26
CVE-2025-71324 [HIGH] CWE-73 Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints.
Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.
VulDB
Flowise up to 3.0.5 /api/v1/get-upload-file streamStorageFile chatId file inclusion (GHSA-99pg-hqvx-r4gf)
vuldb·2026-06-26·CVSS 7.5
CVE-2025-71324 [HIGH] Flowise up to 3.0.5 /api/v1/get-upload-file streamStorageFile chatId file inclusion (GHSA-99pg-hqvx-r4gf)
A vulnerability labeled as problematic has been found in Flowise up to 3.0.5. This issue affects the function streamStorageFile of the file /api/v1/get-upload-file. Such manipulation of the argument chatId leads to file inclusion.
This vulnerability is listed as CVE-2025-71324. The attack may be performed from remote. There is no available exploit.
The affected component should be upgraded.
VulnCheck
FlowiseAI Flowise External Control of File Name or Path
vulncheck·2025·CVSS 7.5
CVE-2025-71324 [HIGH] FlowiseAI Flowise External Control of File Name or Path
FlowiseAI Flowise External Control of File Name or Path
Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.
Affected: FlowiseAI Flowise
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or
No detection rules found.
Nuclei
Flowise - Path Traversal
nuclei·CVSS 7.5
CVE-2025-71324 [HIGH] Flowise - Path Traversal
Flowise - Path Traversal
Flowise < 3.0.6 contains a path traversal vulnerability caused by improper validation of the chatId parameter in /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints, letting unauthenticated attackers read arbitrary files including sensitive database files.
Template:
id: CVE-2025-71324
info:
name: Flowise - Path Traversal
author: theamanrawat,pdteam
severity: high
description: |
Flowise < 3.0.6 contains a path traversal vulnerability caused by improper validation of the chatId parameter in /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints, letting unauthenticated attackers read arbitrary files including sensitive database files.
impact: |
Unauthenticated attackers can read sensitive files, exposing database c
No writeups or analysis indexed.
2026-06-25
Published
Exploited in the wild