PT-2025-39072 · Flowise · Flowise

Published 2025-09-15 · Updated 2025-09-23 · CVE-2025-59527

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.6 Flowise version 3.0.5

Description A Server-Side Request Forgery (SSRF) vulnerability exists in the /api/v1/fetch-links endpoint of the Flowise application. This allows an attacker to use the Flowise server as a proxy to access internal network web services and explore their link structures. The issue arises because the fetch-links feature performs HTTP requests without validating user-supplied URLs, specifically when the relativeLinksMethod parameter is set to webCrawl or xmlScrape. The fetch() function is called directly with the provided URL, enabling attackers to redirect the server to internal services. This could lead to the exposure of sensitive internal administrative endpoints, such as user management, API keys, and database configuration. An attacker could enumerate internal web service structures and potentially perform lateral movement within an enterprise environment.

Recommendations Update Flowise to version 3.0.6 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-03236

CVE-2025-59527

GHSA-HR92-4Q35-4J3M

Affected Products

Flowise

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59527.json · Exploit
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-hr92-4q35-4j3m · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hr92-4q35-4j3m · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03236 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-59527 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59527 · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.6 · Note
• https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/services/fetch-links/index.ts#L8-L18 · Note
• https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/server/src/controllers/fetch-links/index.ts#L6-L24 · Note
• https://github.com/FlowiseAI/Flowise/blob/5930f1119c655bcf8d2200ae827a1f5b9fec81d0/packages/components/src/utils.ts#L474-L478 · Note
• https://twitter.com/CVEnew/status/1970255640271691779 · Twitter Post
• https://t.me/CVEtracker/33090 · Telegram Post
• https://twitter.com/CCBalert/status/1970496157961826748 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1970293592942846409 · Twitter Post