Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.
References
| Link | Resource |
|---|---|
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf | Exploit Vendor Advisory |
| https://www.vulncheck.com/advisories/flowise-arbitrary-file-read-via-chatid-parameter | Third Party Advisory |
| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf | Exploit Vendor Advisory |
Configurations
History
30 Jun 2026, 05:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf - Exploit, Vendor Advisory |
29 Jun 2026, 18:43
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf - Exploit, Vendor Advisory | |
| References | () https://www.vulncheck.com/advisories/flowise-arbitrary-file-read-via-chatid-parameter - Third Party Advisory | |
| CPE | cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:* | |
| First Time |
Flowiseai flowise
Flowiseai |
25 Jun 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-25 22:16
Updated : 2026-06-30 05:17
NVD link : CVE-2025-71324
Mitre link : CVE-2025-71324
CVE.ORG link : CVE-2025-71324
JSON object : View
Products Affected
flowiseai
- flowise
CWE
CWE-73
External Control of File Name or Path