Description
A vulnerability was determined in FlowiseAI Flowise up to 3.1.2. The impacted element is an unknown function of the file packages/components/nodes/documentloaders/S3/S3.ts of the component S3 Document Loader. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FlowiseAI | Flowise | 3.1.0, 3.1.1, 3.1.2 | — |
Advisories 1
- WID-SEC-2026-2023 Flowise: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Jun 21, 2026
References
- VDB-372611 | FlowiseAI Flowise S3 Document Loader S3.ts path traversal vdb-entry
- VDB-372611 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-12821 | CVE Analysis and Report third-party-advisory
- Submit #837578 | FlowiseAI/Flowise - `packages/components/nodes/documentloaders/S3/S3.ts` - `S3Directory / S3File document loader temporary-file handling` 3.1.2 Path Traversal / Arbitrary Local File Write / Unsafe Cleanup third-party-advisory
- https://github.com/dxz0069/softwareoverflow/blob/main/flowise_s3_loader_object_key_path_traversal_vulndb.md related