CVE-2025-71332CWE-89sql-injection

CVE-2025-71332

Medium · published June 24, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
43.1
In the wild
Unconfirmed
What it is

Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to be executed, including blind and error-based extraction of data from the credential table.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00516 · 43.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-06-24T17:16Z
Affected products (1)
ProductVersionsFixed in
flowiseai/flowise≤ 2.2.7—
References (3)
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9c4c-g95m-c8cp · [email protected]https://www.vulncheck.com/advisories/flowise-sql-injection-in-importchatflows-api-via-chatflow-id-parameter · [email protected]https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9c4c-g95m-c8cp · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 24 JUN 11:53Z
    Flowise - SQL Injection in importChatflows API via chatflow.id Parameter
    cvelistv5