Skip to content
OpenAdvisories
Critical WID-SEC-2025-2048 3 CVEs

Flowise: Mehrere Schwachstellen

Published Sep 14, 2025 · Updated Jul 9, 2026 · Revision 4 · de-DE

Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Flowise ausnutzen, um beliebigen Programmcode auszuführen, und um Informationen offenzulegen.

Product

Flowise ist eine Benutzeroberfläche zur Erstellung von LLMs (Large Language Model).

Vulnerabilities 3

  • Critical 9.8
    CVE-2025-58434 Public exploit Scanner template EPSS 84%

    Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover

    Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication …

    FlowiseAI Flowise flowise npm
  • Critical 9.8
    CVE-2025-71336

    Flowise - Unsandboxed Remote Code Execution via Custom MCP

    Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local MCP servers. Because Flowise's authentic…

    Flowise Flowise flowise npm
  • High 7.5
    CVE-2025-71324 Scanner template

    Flowise - Arbitrary File Read via chatId Parameter

    Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fa…

    Flowise Flowise flowise npm

Revision history

  1. #4

    Updates aufgenommen

  2. #3

    Referenz(en) aufgenommen: CVE-2025-71324, EUVD-2025-210336, CVE-2025-71336, EUVD-2025-210342

  3. #2

    Referenz(en) aufgenommen: EUVD-2025-29248, EUVD-2025-29243, EUVD-2025-29245, EUVD-2025-29246, EUVD-2025-29247

  4. #1

    Initiale Fassung

References