CVE-2025-71338CWE-73

CVE-2025-71338

Critical · published June 26, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
66.8
In the wild
Unconfirmed
What it is

Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01157 · 66.8th percentile
Weakness
CWE-73 · External Control of File Name or Path
Published
2026-06-26T02:16Z
Affected products (1)
ProductVersionsFixed in
flowiseai/flowise≤ 3.1.3—
References (4)
https://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.2.7-patch.1 · [email protected]https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948 · [email protected]https://www.vulncheck.com/advisories/flowise-arbitrary-file-write-to-remote-code-execution-via-document-store-api · [email protected]https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 25 JUN 21:41Z
    Flowise - Arbitrary File Write to Remote Code Execution via document-store API
    cvelistv5