Flowise CVE-2025-71334

No authentication is required (CVSS PR:N) because the /api/v1/chatflows, /api/v1/get-upload-file, and /api/v1/openai-assistants-file/download endpoints are in Flowise's WHITELIST_URLS; the only prerequisite is network reachability to a Flowise instance running an affected version (2.2.8 ≤ version < 3.0.6), exploited against default configuration. The concrete trigger is supplying a non-UUID, non-numeric path-traversal value (e.g., '../../../../../tmp') in the chatflowId or chatId parameter of a file-handling request. Limiting factors: the instance must be network-accessible to the attacker (an internal-only or proxy-gated deployment narrows reach), and escalating the file-write primitive to full RCE depends on the host layout and where a written file can be executed; pure file read is directly achievable.

All available signals point to a genuine high priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H/VA:H, base 9.3) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact, and the advisory explicitly notes the affected endpoints sit in WHITELIST_URLS so no authentication is required. A working proof-of-concept is published, raising practical exploitability, and arbitrary file write provides a credible RCE path. No EPSS score and no KEV listing were provided, so there is no confirmation of widespread or active exploitation - the elevated risk rests on ease of exploitation and PoC availability rather than observed in-the-wild activity. No metrics conflict; the description (unauthenticated, network endpoints) is consistent with the CVSS vector.

An attacker reachable over the network sends a POST to /api/v1/chatflows with base64 file data and a chatflowId of '../../../../../tmp' (or a path leading into a web-executable or startup directory), causing Flowise to write attacker-controlled content outside the storage directory; planting an executable or config file then yields remote code execution. Read-side, the attacker requests /api/v1/get-upload-file with a traversal chatId to exfiltrate sensitive host files such as credentials or environment configs. A proof-of-concept against a default localhost deployment is included in the vendor advisory.