Flowise CVE-2025-71338

No special conditions - remote unauthenticated exploitation against default configurations of Flowise <= 2.2.7, exploitable directly via the network-reachable /api/v1/document-store/loader/process endpoint with a fileName parameter containing ../ traversal sequences. The primary limiting factor is the RCE trigger: the package.json overwrite technique requires the application to restart (re-running the start/build script) before injected code executes, so payload execution is deferred rather than immediate; an attacker may also rely on alternative writable targets for faster execution. Exploitation requires that the instance be network-reachable and that the process have write permission to the targeted file (e.g., package.json), so read-only deployment or strict file permissions reduce feasibility.

All available signals point to maximum priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and full High impact across confidentiality, integrity and availability of both the vulnerable and subsequent systems, yielding a 10.0. A working PoC is published in the vendor's GHSA advisory and corroborated by VulnCheck, so exploitation is proven feasible rather than theoretical. No EPSS score and no CISA KEV entry were provided in the input, so I cannot confirm widespread or active in-the-wild exploitation; the absence of KEV suggests it is not yet a documented mass-exploitation event, but given the trivial unauthenticated nature and public PoC, defenders should treat exploitation as imminent. One nuance limiting blast radius: RCE via the package.json technique is not instantaneous - it triggers when the application restarts and re-runs the start script - though arbitrary file write also enables other immediate RCE paths.

An attacker on the network sends a single crafted POST to /api/v1/document-store/loader/process with a fileName like ../../../../package.json and base64 file content that rewrites the scripts.start entry to include an attacker command (the published PoC uses touch /tmp/pyozzi-poc && run-script-os). No credentials or user interaction are needed. The malicious command executes the next time the host runs the start script (e.g., on container or service restart), giving the attacker code execution as the Flowise process user.