PT-2026-56430 · Flowise · Flowise

Tenbbughunters · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-56273

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated users. Attackers with valid API tokens can write vector store data to arbitrary filesystem locations, potentially enabling code execution or data exfiltration.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-56273

Affected Products

Flowise

References · 3

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w6v6-49gh-mc9w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56273 · Security Note
• https://vulncheck.com/advisories/flowise-path-traversal-in-vector-store-basepath-parameter · Note