PT-2026-56430 · Flowise · Flowise

Tenbbughunters · Publicado 2026-07-08 · Atualizado 2026-07-08 · CVE-2026-56273

NVD

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated users. Attackers with valid API tokens can write vector store data to arbitrary filesystem locations, potentially enabling code execution or data exfiltration.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-56273

Produtos afetados

Flowise

Referências · 3

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w6v6-49gh-mc9w · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-56273 · Nota de Segurança
• https://vulncheck.com/advisories/flowise-path-traversal-in-vector-store-basepath-parameter · Nota