What is the CVSS score of CVE-2025-61913?

CVE-2025-61913 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 13.0%.

Which versions of Flowise are affected by CVE-2025-61913?

Flowise deployments prior to 3.0.8 are exposed to a critical arbitrary file read/write issue that an authenticated flow-builder user can use to reach application and host secrets, and publicly…. A patch is available.

Is there a public PoC exploit available for CVE-2025-61913?

Yes, a public proof-of-concept exploit is available for CVE-2025-61913. Prioritise patching immediately. EPSS: 13.0%.

How to fix or mitigate CVE-2025-61913?

Within 24 hours, identify all Flowise instances and upgrade to vendor-released patch 3.0.8 or later; if immediate patching is not possible, isolate affected instances from untrusted networks, disable open self-registration, restrict flow-builder access to trusted administrators, and rotate any secrets or credentials that may have been exposed, including Flowise encryption keys, database files, SSH private keys, and system credential stores. Within 7 days, verify patch deployment across all environments, review authentication and audit logs for unauthorized file access or flow modifications, enforce least privilege and network segmentation, and rotate API keys, database credentials, and SSH keys if compromise is suspected. Within 30 days, validate that no vulnerable Flowise versions remain, conduct a broader secrets-management review, add monitoring for suspicious file-path access and flow creation, and update secure configuration baselines to prevent open registration and excessive file permissions.

Flowise CVE-2025-61913

CRITICAL

Path Traversal (CWE-22)

2025-10-08 security-advisories@github.com

Path Traversal Flowise Flowiseai

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable tool with low-privileged auth (PR:L) and no user interaction; unvalidated path read/write breaks the app boundary to the host OS (S:C) enabling full file read, write, and RCE (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 30, 2026 - 16:55 vuln.today

CVE Published

Oct 08, 2025 - 23:15 nvd

CRITICAL 9.9

DescriptionNVD

Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability.

AnalysisAI

Arbitrary file read and write in Flowise versions prior to 3.0.8 allows an authenticated attacker with access to the flow builder to read or overwrite any file the Flowise process can reach, including secrets such as /root/.flowise/encryption.key and database.sqlite in Docker deployments, or /etc/shadow and SSH private keys on bare-metal installs. The issue is rated 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-22) and publicly available exploit code exists, so the barrier is mainly the need for a valid account and the ability to add the vulnerable file tools to a flow; command execution is achievable through arbitrary file write to sensitive paths rather than being guaranteed by the traversal alone. No CISA KEV listing or confirmed in-the-wild exploitation has been reported, but default deployments that permit open self-registration are effectively wide open to this chain.

Technical ContextAI

The root cause is CWE-22 improper limitation of a pathname to a restricted directory. Flowise ships two LangChain-style tools, ReadFileTool and WriteFileTool, in packages/components/nodes/tools/ReadFile/ReadFile.ts and packages/components/nodes/tools/WriteFile/WriteFile.ts, each extending StructuredTool and delegating to the NodeFileStore class from langchain/stores/file/node. Their zod schema accepted a single user-supplied file_path string and passed it straight into store.readFile()/writeFile() with no canonicalization, no check that the resolved path stayed under a configured base directory, no extension allow-list, and no file-size cap. An attacker who controls a flow (authenticated, PR:L) therefore supplies an absolute path or traversal sequence and the tool happily operates outside its intended workspace. The 3.0.8 fix replaces NodeFileStore with a new SecureFileStore (packages/components/src/SecureFileStore) configured via FileSecurityConfig, which introduces a workspacePath root, an enforceWorkspaceBoundaries boolean that defaults to true, a maxFileSize limit (default 10 MB) and an allowedExtensions allow-list; the tool schema itself moves from 'basePath' to 'workspacePath' and bumps the node version to 2.0, and when no workspace path is given and boundaries are enforced it falls back to ~/.flowise, while explicitly disabling boundaries logs a security warning and constructs an unsecured store. The affected supply-chain artifacts are the npm packages flowise and flowise-components (both CPE-mapped as cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*).

RemediationAI

The primary fix is to upgrade to Flowise 3.0.8 or later - npm install flowise@3.0.8 and flowise-components@3.0.8, or pull a rebuilt flowiseai/flowise image tagged 3.0.8 or newer - which is the vendor-released patch containing commit 1fb12cd93143592a18995f63b781d25b354d48a3; after upgrading, re-open existing flows and set an explicit 'Workspace Path', keep 'Enforce Workspace Boundaries' enabled (it defaults to true), and apply the new Max File Size and Allowed Extensions restrictions. See https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-j44m-5v8f-gc9c and https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jv9m-vf54-chjj for details. If you cannot patch immediately, the most effective compensating controls are to disable open self-registration and restrict the flow-builder role to trusted operators, and to remove or stop using the ReadFileTool and WriteFileTool nodes in any exposed flow (trade-off: loss of file-based agent functionality, which may break existing automations). Additionally, run Flowise as a non-root user in a container with only the required directories bind-mounted read-only (for example omit /root/.flowise from writable mounts, which protects encryption.key and database.sqlite but may break legitimate persistence), block the Flowise UI/API port from untrusted networks with a reverse proxy or firewall, and rotate any secrets, SSH keys, or Flowise encryption keys that may already reside on a host where untrusted users had builder access. Note that no combination of these workarounds fully restores the pre-patch read/write isolation, so upgrading remains the only complete remediation.