GHSA-8vvx-qvq9-5948: Flowise allows arbitrary file write to RCE
(updated )
An attacker could write files with arbitrary content to the filesystem via the /api/v1/document-store/loader/process API.
An attacker can reach RCE(Remote Code Execution) via file writing.
References
- github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7
- github.com/FlowiseAI/Flowise/releases/tag/flowise%402.2.7-patch.1
- github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948
- github.com/advisories/GHSA-8vvx-qvq9-5948
- nvd.nist.gov/vuln/detail/CVE-2025-71338
- www.vulncheck.com/advisories/flowise-arbitrary-file-write-to-remote-code-execution-via-document-store-api
Code Behaviors & Features
Detect and mitigate GHSA-8vvx-qvq9-5948 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →