CVE-2025-71332: SQL Injection in Flowise importChatflows API – MEDIUM Severity Credential Extraction

Technical summary

The vulnerability exists in the importChatflows API endpoint of Flowise versions through 2.2.7. When processing a JSON import file, the application concatenates an unsanitized chatflow.id value directly into a SQL IN clause without parameterization. This allows an authenticated user to inject arbitrary SQL syntax. Exploitation can leverage blind SQL injection techniques (timing-based inference) or error-based extraction methods to read data from the credential table. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Business impact

This vulnerability poses a significant insider threat and privilege-escalation risk. While exploitation requires authentication, a compromised or malicious user account can silently exfiltrate sensitive credentials stored within Flowise, such as API keys for downstream services, database passwords, and cloud authentication tokens. This can lead to lateral movement, unauthorized access to connected systems, and data breaches affecting all services that trust those credentials. Organizations relying on Flowise for multi-tenant or shared workflow scenarios face heightened risk.

Affected systems

Flowise versions up to and including 2.2.7 are affected. Verify the exact patched version against the vendor advisory, as updates may have been released post-publication. The vulnerability requires an authenticated session; unauthenticated users cannot directly exploit it. However, any user with valid Flowise credentials—including those in test, staging, or development environments—can attempt exploitation.

Exploitability

Exploitation requires a valid Flowise user account, making opportunistic attacks less likely than targeted insider threats. However, the attack is straightforward: an attacker can craft a malicious JSON import file with SQL injection payloads in the ID field and use the standard import UI or API. No special tools or zero-day knowledge is needed once authentication is obtained. The attack is reliable and reproducible, with no user interaction required beyond the initial file upload.

Remediation

Organizations should immediately upgrade Flowise to a patched version (verify current availability with the vendor). As an interim measure, restrict the importChatflows API endpoint to trusted administrators only, disable bulk import functionality if not essential, and monitor import activity for suspicious patterns. Review and rotate any credentials that may have been stored in Flowise' credential table, particularly those used for critical systems.

Patch guidance

Check the FlowiseAI repository and official releases for version 2.2.8 or later, which should include input validation fixes for the chatflow.id parameter. Ensure SQL statements are rewritten to use parameterized queries or prepared statements. After patching, test import functionality with standard workflows to confirm no regression. Consider upgrading as part of your standard change management process, prioritizing production instances.

Detection guidance

Monitor application logs for importChatflows API requests containing unusual characters (single quotes, semicolons, SQL keywords) in the ID field of JSON payloads. Enable SQL query logging at the database level to detect suspicious syntax patterns. Look for repeated failed or error-based queries, which may indicate blind SQL injection attempts. Audit user accounts that perform imports, especially outside normal business hours or from unusual locations. Check for unexpected access to the credential table.

Why prioritize this

Although the CVSS score is 6.5 (MEDIUM), this vulnerability warrants elevated priority because it directly threatens credential confidentiality and is reliably exploitable by authenticated users. The credential table is high-value; compromise enables supply-chain-style attacks on connected systems. This is not a KEV entry, so no immediate patch is mandated by government timelines, but the attack path is clear and the data at risk is critical. Organizations should treat this as HIGH priority within their own vulnerability management program.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a MEDIUM severity due to the authentication requirement (PR:H) and limited scope. However, the score does not fully capture the business risk: confidentiality impact is HIGH, integrity impact is HIGH (potential for data modification via SQL UPDATE or INSERT), and availability impact is NONE. The requirement for an authenticated session significantly reduces the attack surface compared to unauthenticated SQL injection, but does not eliminate risk in environments with shared or compromised credentials.

Frequently asked questions