PT-2025-41318 · Flowise · Flowise

Xlabaiteam · Published 2025-10-08 · Updated 2025-10-20 · CVE-2025-61913

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.8

Description Flowise is a drag and drop user interface used to build customized large language model flows. Versions prior to 3.0.8 contain a flaw in the WriteFileTool and ReadFileTool components where file path access is not restricted. This allows authenticated attackers to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Approximately 12.7k potential targets have been identified. The issue involves unrestricted file path access within the ReadFileTool and WriteFileTool components, enabling attackers to pivot from file access.

Recommendations Update Flowise to version 3.0.8 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-61913

GHSA-J44M-5V8F-GC9C

GHSA-JV9M-VF54-CHJJ

Affected Products

Flowise

References · 24

• 🔥 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-j44m-5v8f-gc9c · Exploit
• 🔥 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jv9m-vf54-chjj · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61913.json · Exploit
• https://github.com/FlowiseAI/Flowise/commit/1fb12cd93143592a18995f63b781d25b354d48a3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-61913 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61913 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j44m-5v8f-gc9c · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jv9m-vf54-chjj · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://github.com/FlowiseAI/Flowise/pull/5275 · Note
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.8 · Note
• https://t.me/pentestingnews/69312 · Telegram Post
• https://twitter.com/zoomeye_team/status/1976483069503910161 · Twitter Post
• https://t.me/cveNotify/138548 · Telegram Post
• https://t.me/CSIRT_italia/2792 · Telegram Post