PT-2025-41318 · Flowise · Flowise

Xlabaiteam · Published 2025-10-08 · Updated 2025-10-20 · CVE-2025-61913

Positive Technologies · (AI Summary)

CVSS v3.1

9.9

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.8

Description Flowise is a drag and drop user interface used to build customized large language model flows. Versions prior to 3.0.8 contain a flaw in the

WriteFileTool

and

ReadFileTool

components where file path access is not restricted. This allows authenticated attackers to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Approximately 12.7k potential targets have been identified. The issue involves unrestricted file path access within the

ReadFileTool

and

WriteFileTool

components, enabling attackers to pivot from file access.

Recommendations Update Flowise to version 3.0.8 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-61913

GHSA-J44M-5V8F-GC9C

GHSA-JV9M-VF54-CHJJ

Affected Products

Flowise

References · 24

• 🔥 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jv9m-vf54-chjj · Exploit
• 🔥 https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-j44m-5v8f-gc9c · Exploit
• https://github.com/FlowiseAI/Flowise/commit/1fb12cd93143592a18995f63b781d25b354d48a3 · Patch
• https://osv.dev/vulnerability/GHSA-j44m-5v8f-gc9c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-61913 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61913 · Security Note
• https://osv.dev/vulnerability/GHSA-jv9m-vf54-chjj · Vendor Advisory
• https://github.com/FlowiseAI/Flowise · Note
• https://github.com/FlowiseAI/Flowise/pull/5275 · Note
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.8 · Note
• https://twitter.com/CrowdCyber_Com/status/1976182519000170828 · Twitter Post
• https://twitter.com/zoomeye_team/status/1976483069503910161 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o28ww8/resumen_diario_de_vulnerabilidades_09102025 · Reddit Post
• https://twitter.com/CVEnew/status/1976057647020261440 · Twitter Post
• https://t.me/cveNotify/138548 · Telegram Post