CVE-2025-71324: Flowise Unauthenticated Path Traversal & Database Disclosure

Technical summary

The vulnerability is a path traversal flaw affecting the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints in Flowise versions prior to 3.0.6. The chatId parameter is not validated before being passed to the streamStorageFile() function. While the function contains a storage-directory containment check, a fallback file-lookup path is constructed without the orgId parameter and evaluated after that check, allowing an attacker to bypass containment restrictions. This enables directory traversal sequences (e.g., "../../") to access files outside the intended storage directory. In typical installations, this allows reading /root/.flowise/database.sqlite, which holds the complete application database. The flaw is classified as CWE-73 (External Control of File Name or Path).

Business impact

If Flowise is used in production as part of a customer-facing or internal AI service, this vulnerability exposes the entire application database to unauthorized access. This includes user accounts, API keys, conversation histories, and any stored credentials or integration tokens. For organizations integrating Flowise with external APIs or data sources, compromised tokens could enable lateral movement or further unauthorized access. The breach is silent and undetectable without file-access auditing, making this particularly dangerous for data-sensitive deployments. Regulatory compliance issues (GDPR, HIPAA, etc.) may arise if personal data or health information is stored in conversations.

Affected systems

All Flowise installations prior to version 3.0.6 are affected. This includes self-hosted deployments and any containerized instances running earlier versions. The default configuration is particularly vulnerable because the database file resides in a predictable location (/root/.flowise/database.sqlite). Deployments with custom storage configurations or access restrictions may have reduced exposure, but the underlying flaw persists across all affected versions.

Exploitability

Exploitation is trivial and requires no authentication, credentials, or user interaction. An attacker can craft a simple HTTP request to either vulnerable endpoint with a path-traversal payload in the chatId parameter. No special tools or advanced techniques are needed; a command-line HTTP client or browser suffices. The vulnerability is network-accessible if Flowise is exposed to the internet or an untrusted network. The only friction is discovering a Flowise instance and identifying the correct file paths to target, but the default database location makes this straightforward in standard deployments.

Remediation

Upgrade Flowise to version 3.0.6 or later. This version includes validation of the chatId parameter and ensures that fallback file-lookup paths respect the orgId and storage-directory containment checks. Organizations unable to upgrade immediately should implement network-level controls to restrict access to Flowise instances, disable the affected endpoints if not in use, and consider isolating Flowise on a network segment inaccessible to untrusted users. Additionally, audit file-access logs to detect if the database or other sensitive files have been read.

Patch guidance

Verify that your Flowise deployment is running version 3.0.6 or later by checking the application version in the admin UI or reviewing the package.json or release tags in your repository. If you are running an earlier version, upgrade via your standard deployment method (npm, Docker, git pull, etc.) and restart the application. Test the upgrade in a non-production environment first to ensure no configuration or custom integrations are broken. After upgrading, restart all Flowise instances and verify that file-download endpoints function normally for legitimate use cases.

Detection guidance

Monitor for HTTP requests to /api/v1/get-upload-file or /api/v1/openai-assistants-file/download endpoints containing path-traversal sequences such as "../", "..\\", or URL-encoded variants (%2e%2e%2f). Log the chatId parameter values and alert on any that deviate from expected UUID or file-ID formats. Check file-access logs (e.g., via auditd on Linux) for unexpected reads of /root/.flowise/database.sqlite or other sensitive files, particularly if they correlate with Flowise API requests. Review web server or reverse-proxy logs for 200-status responses on these endpoints paired with suspicious parameters.

Why prioritize this

This vulnerability merits immediate attention because it requires no authentication, is trivial to exploit, and directly exposes the entire application database. The CVSS score of 7.5 reflects high confidentiality impact with no integrity or availability damage, but the practical risk is substantial for any production Flowise deployment handling sensitive data. The lack of a KEV listing and low deployment baseline of Flowise mean it may not be actively exploited at scale yet, but opportunistic attackers scanning for exposed Flowise instances will find this easy prey.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects an attack vector of Network (AV:N), low attack complexity (AC:L), no privilege required (PR:N), no user interaction (UI:N), unchanged scope (S:U), high confidentiality impact (C:H), and no integrity or availability impact (I:N, A:N). This appropriately captures the ease of exploitation and direct exposure of sensitive data. The score does not account for the likelihood of an organization storing regulated data in Flowise or the cascading impact of compromised API tokens, so real-world risk may be higher in sensitive deployments.

Frequently asked questions