Live › vulnerability › GHSA-c3hj-m5hq-59xw
Flowise, an AI workflow builder, has a path traversal flaw in its document-store loader endpoint that lets unauthenticated users write arbitrary files. An attacker can overwrite files such as package.json so that code runs when the application restarts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:41 UTC. All times on this page are UTC.
This advisory is withdrawn as a duplicate of GHSA-8vvx-qvq9-5948, so the live record is that advisory. Teams running Flowise <= 2.2.7 that expose the document-store loader endpoint are the ones to look at. Teams that do not run Flowise can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| flowise | npm | <= 2.2.7 | – |
npm ls flowise and compare it to the affected range <= 2.2.7/api/v1/document-store/loader/process endpoint on internet-facing Flowise serversNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-8vvx-qvq9-5948. This link is maintained to preserve external references.
Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.
This page as .md · .json · in your agent: get_signal("GHSA-c3hj-m5hq-59xw")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.