Critical WID-SEC-2025-0569 1 CVE

Flowise: Schwachstelle ermöglicht Codeausführung

Published Mar 16, 2025 · Updated Jun 25, 2026 · Revision 2 · de-DE

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Flowise ausnutzen, um beliebigen Programmcode auszuführen.

Product

Flowise ist eine Benutzeroberfläche zur Erstellung von LLMs (Large Language Model).

Vulnerabilities 1

Critical 10.0

CVE-2025-71338 Public exploit

Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API

Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and over…

Flowise Flowise flowise npm

Jun 25, 2026

Revision history

2026-06-25 #2
Referenz(en) aufgenommen: CVE-2025-71338, EUVD-2025-210343
2025-03-16 #1
Initiale Fassung

References

GitHub Security Advisory GHSA-8vvx-qvq9-5948 vom 2025-03-16
https://github.com/advisories/GHSA-8vvx-qvq9-5948
GitHub Advisory Database vom 2025-03-16
https://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7