CVE-2025-61913

🚨 An authenticated attacker can write or read files on your server with absolute freedom! This oversight in Flowise prior to version 3.0.8 is like giving someone a master key to every room in your building — and they didn’t even need to pick the lock! 🔥 Imagine a hotel where any guest can stroll into the staff-only areas and access everything from personnel files to the safe. That’s what’s happening here: the WriteFileTool and ReadFileTool don’t restrict access, allowing unauthorized file operations to run rampant. This weakness could lead to devastating consequences, such as exposing sensitive information, tampering with critical files, or even executing arbitrary commands on the server. An attacker could hijack the entire system, wreaking havoc and potentially compromising your entire infrastructure.

This weakness could lead to devastating consequences, such as exposing sensitive information, tampering with critical files, or even executing arbitrary commands on the server. An attacker could hijack the entire system, wreaking havoc and potentially compromising your entire infrastructure. To secure your system, immediately update Flowise to version 3.0.8 or later. Additionally, review your file permissions and audit your server's access controls to ensure no potential threats are lurking. Don't wait to act! You've got this! Stay proactive and secure your Flowise installation today! 🛡️