{"id":"GHSA-c3hj-m5hq-59xw","kind":"vulnerability","aliases":["GHSA-c3hj-m5hq-59xw"],"related":[],"title":"Duplicate Advisory : Flowise allows arbitrary file write to RCE","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-8vvx-qvq9-5948. This link is maintained to preserve external references.\n\n### Original Description\n\nFlowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.","summary":"Flowise, an AI workflow builder, has a path traversal flaw in its document-store loader endpoint that lets unauthenticated users write arbitrary files. An attacker can overwrite files such as package.json so that code runs when the application restarts.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"flowise","fixed":[],"affected":"<= 2.2.7","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","cwe-73","flowise","node","npm","self-hosted"],"not_affected_if":["flowise-not-installed","version-above-2.2.7"],"how_to_check":"- Check the installed Flowise version with `npm ls flowise` and compare it to the affected range `<= 2.2.7`\n- Look for exposure of the `/api/v1/document-store/loader/process` endpoint on internet-facing Flowise servers","fix":null,"status":"withdrawn","published_at":"2026-06-26T00:32:05+00:00","first_seen_at":"2026-11-03T17:41:48+00:00","triaged_at":"2026-11-03T17:42:41+00:00","updated_at":"2026-11-03T17:42:41+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-03T17:42:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Flowise: unauthenticated file write through document loader enables code execution","impact":"high","summary":"Flowise, an AI workflow builder, has a path traversal flaw in its document-store loader endpoint that lets unauthenticated users write arbitrary files. An attacker can overwrite files such as package.json so that code runs when the application restarts.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["flowise","npm","self-hosted","node"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker overwrites package.json and runs code on the server","analyst_note":"Advisory is withdrawn as duplicate; confirm the canonical record GHSA-8vvx-qvq9-5948 for fixed version and check steps.","how_to_check":"- Check the installed Flowise version with `npm ls flowise` and compare it to the affected range `<= 2.2.7`\n- Look for exposure of the `/api/v1/document-store/loader/process` endpoint on internet-facing Flowise servers","plain_action":"","needs_analyst":true,"not_affected_if":["flowise-not-installed","version-above-2.2.7"],"who_is_affected":"This advisory is withdrawn as a duplicate of GHSA-8vvx-qvq9-5948, so the live record is that advisory. Teams running Flowise `<= 2.2.7` that expose the document-store loader endpoint are the ones to look at. Teams that do not run Flowise can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000713,"input_tokens":4249,"output_tokens":577,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-73':25B '/api/v1/document-store/loader/process':108C '5948':89C '59xw':14A,19A '8vvx':87C 'achiev':136C 'advisori':2A,73C,75C 'ai':22B,34B 'ai-tool':21B 'allow':4A,111C 'applic':70B,142C 'arbitrari':5A,54B,116C 'attack':57B,113C,121C 'builder':36B 'c3hj':12A,17A 'code':66B,138C 'contain':101C 'critic':131C 'cwe':24B 'descript':99C 'document':45B 'document-stor':44B 'duplic':1A,72C,83C 'endpoint':48B,109C 'execut':139C 'exploit':123C 'extern':96C 'file':6A,55B,60B,117C,132C 'filenam':125C 'filesystem':120C 'flaw':41B 'flowis':3A,26B,32B,100C 'flowise':20A 'ghsa':11A,16A,86C 'ghsa-8vvx-qvq9':85C 'ghsa-c3hj-m5hq-59xw':10A,15A 'host':31B 'let':50B 'like':133C 'link':91C 'loader':47B 'm5hq':13A,18A 'maintain':93C 'node':27B 'npm':28B 'origin':98C 'overwrit':59B,130C 'package.json':63B,134C 'paramet':126C 'path':39B,103C 'preserv':95C 'qvq9':88C 'rce':9A 'refer':97C 'remot':137C 'restart':71B,143C 'run':67B 'self':30B 'self-host':29B 'sequenc':128C 'store':46B 'tool':23B 'travers':40B,104C 'unauthent':51B,112C 'unsanit':124C 'user':52B 'vulner':105C 'withdrawn':78C 'workflow':35B 'write':7A,53B,115C","nicknames":[],"mitigations":[],"who_affected":"This advisory is withdrawn as a duplicate of GHSA-8vvx-qvq9-5948, so the live record is that advisory. Teams running Flowise `<= 2.2.7` that expose the document-store loader endpoint are the ones to look at. Teams that do not run Flowise can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["flowise"],"ptokens":["flowise"],"labels":["aitooling","critical","cwe73","flowise","node","npm","selfhosted"],"campaign_type":null,"first_public_at":"2026-06-26T00:32:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-c3hj-m5hq-59xw","url":"https://github.com/advisories/GHSA-c3hj-m5hq-59xw","severity":"critical","published_at":"2026-06-26T00:32:05+00:00","modified_at":"2026-11-03T17:36:50+00:00","first_seen_at":"2026-11-03T17:41:48+00:00","fetched_at":"2026-11-03T17:41:48+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}