CVE-2026-56273: Flowise Path Traversal in Vector Store – Impact & Patch Guidance

Technical summary

CVE-2026-56273 is a path traversal vulnerability (CWE-22) affecting Flowise's Faiss and SimpleStore vector store implementations. The vulnerability exists in how these components handle the basePath parameter, which is accepted directly from authenticated API requests without proper normalization or validation. An attacker with a valid API token can supply specially crafted basePath values containing directory traversal sequences (e.g., '../../../') to write vector store files—which may include serialized Python objects or executable code—to arbitrary filesystem locations outside the intended storage directory. The CVSS 3.1 score of 6.5 (MEDIUM severity) reflects the integrity impact (high) and authentication requirement, with no direct confidentiality or availability consequences in the base metric.

Business impact

Successful exploitation could lead to integrity compromise of the application and underlying server. If an attacker writes malicious files to directories in the application's module path or web root, code execution becomes possible. Data exfiltration risks also exist if sensitive files can be overwritten or if the attacker gains write access to backup or log directories. For organizations using Flowise in production AI/ML pipelines, this vulnerability poses a moderate but material risk, especially in zero-trust or defense-in-depth strategies where API token compromise should not automatically grant filesystem write access beyond application-controlled boundaries.

Affected systems

Flowise versions prior to 3.1.0 are affected. The vulnerability is specific to the Faiss and SimpleStore vector store backends; other vector store implementations in Flowise may not be vulnerable. The risk is limited to deployments where API access is available to untrusted or insufficiently monitored users, and where the application runs with sufficient filesystem permissions to write across multiple directories.

Exploitability

Exploitation requires a valid API token, which raises the barrier compared to unauthenticated vulnerabilities. However, in environments with weak token management, token reuse across services, or tokens embedded in client-side code, this requirement is not a strong control. An attacker would craft a request with a malicious basePath parameter and invoke the vector store creation or update endpoint. No user interaction is required, and the network is directly accessible to any holder of a valid token. The attack is straightforward once credentials are obtained.

Remediation

Upgrade Flowise to version 3.1.0 or later, which addresses the path traversal vulnerability by implementing proper basePath validation and normalization. In addition to patching, review API token distribution, rotation policies, and access controls to limit exposure of valid credentials. Consider implementing filesystem-level restrictions (e.g., chroot, containers, SELinux) to constrain the scope of write operations even if the application vulnerability is exploited.

Patch guidance

Apply Flowise version 3.1.0 or newer as soon as feasible. Verify the patch against the vendor advisory to confirm which vector store implementations are addressed. If you are unable to patch immediately, disable or restrict API access for untrusted users and monitor API logs for suspicious basePath parameters (those containing '..', '/', or other traversal indicators). Consider deploying the application in a container or isolated filesystem to limit the damage of a successful exploit.

Detection guidance

Monitor API logs for requests to vector store endpoints (Faiss, SimpleStore) that include basePath parameters with traversal sequences such as '../', '..\', or absolute paths beginning with '/'. Flag any POST or PUT requests where the basePath value differs significantly from expected naming conventions or exceeds the application's configured storage directory. Endpoint access logs and application-level audit trails should capture token usage patterns; correlate token use with suspicious filesystem writes to non-standard directories. File integrity monitoring on directories outside the intended vector store location can also detect unauthorized writes.

Why prioritize this

This vulnerability merits prompt but not emergency attention. The MEDIUM CVSS score, authentication requirement, and limited scope (specific vector store implementations) place it below critical/high-severity vulnerabilities. However, the potential for code execution if exploited, combined with the ease of exploitation once a token is compromised, justifies prioritization within your patch windows. Assess your API token distribution and monitoring practices first; if tokens are tightly controlled and monitored, you can defer patching slightly. If tokens are widely distributed or embedded in client code, prioritize the upgrade.

Risk score, explained

CVSS 3.1 score of 6.5 reflects a vulnerability with high integrity impact (attacker can overwrite files) and a requirement for low-privilege authentication (PR:L). No confidentiality loss or availability impact is implied by the base score, though exploitation could indirectly lead to both. The MEDIUM severity is appropriate given the need for valid credentials and the specificity to two vector store backends; widespread damage is not automatic, but potential for code execution elevates the concern beyond a simple information disclosure or low-impact file write.

Frequently asked questions