Description
Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Flowise | Flowise | ≤ 2.2.7 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
majpuV/flowise-arbitrary-file-read-getFileFromStorage ★ 0 · Aug 3, 2026
Unauthenticated arbitrary file read in Flowise (< 2.2.4) via path traversal in getFileFromStorage (storageUtils.ts). Caused by un-sanitized file path combined with mass-assignment in PUT /api/v1/docu…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | flowise | <= 2.2.7 | — | GHSA-8vvx-qvq9-5948 |
Advisories 1
- WID-SEC-2025-0569 Flowise: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jun 25, 2026
References
- GitHub Security Advisory (GHSA-8vvx-qvq9-5948) vendor-advisory
- Flowise flowise%402.2.7-patch.1 Release Notes release-notes
- VulnCheck Advisory: Flowise - Arbitrary File Write to Remote Code Execution via document-store API third-party-advisory