EUVD-2026-42251
GHSA-g8g5-48h4-5r8h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Valid API token required (PR:L); arbitrary filesystem write crosses component boundary (S:C) with high host integrity impact; no confidentiality or availability impact described.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated users. Attackers with valid API tokens can write vector store data to arbitrary filesystem locations, potentially enabling code execution or data exfiltration.
AnalysisAI
Path traversal in Flowise's Faiss and SimpleStore vector store implementations allows any holder of a valid API token to write vector store data to arbitrary filesystem locations, creating a practical path to remote code execution or data exfiltration on the hosting server. All Flowise deployments prior to version 3.1.0 are affected when either of these two vector store backends is configured. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the post-authentication exploitation path is low-complexity, making timely patching critical especially in multi-tenant or shared deployments where API tokens are broadly distributed.
Technical ContextAI
Flowise is an open-source low-code platform for building LLM-powered workflows, hosted at FlowiseAI/Flowise on GitHub. The vulnerability resides in two specific vector store integrations: FAISS (Facebook AI Similarity Search), a high-performance library for embedding similarity search, and SimpleStore, a lightweight in-process vector store. Both implementations expose a basePath configuration parameter that controls where index files are persisted to disk. In versions before 3.1.0, this parameter is accepted directly from API request input without sanitization or path confinement, a textbook CWE-22 (Path Traversal) root cause. By injecting directory traversal sequences such as '../../' into the basePath value, an authenticated attacker can redirect write operations outside the intended storage directory to any path accessible to the Flowise process user, including web roots, cron directories, or application configuration paths that could enable follow-on code execution.
RemediationAI
The primary fix is upgrading Flowise to version 3.1.0 or later, which remediates path traversal by sanitizing the basePath parameter within both the Faiss and SimpleStore vector store implementations. Consult the GitHub Security Advisory (https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w6v6-49gh-mc9w) and VulnCheck advisory (https://www.vulncheck.com/advisories/flowise-path-traversal-in-vector-store-basepath-parameter) to confirm the patch. If an immediate upgrade is not feasible, the most effective compensating control is confining the Flowise process to a dedicated low-privilege OS user with write access restricted to the vector store directory via OS-level mandatory access control (AppArmor or SELinux policy) - this limits the attacker's ability to write to sensitive paths such as /etc, cron directories, or web roots, though it does not eliminate the traversal itself. Additionally, audit and restrict distribution of API tokens to the minimum necessary users, and place the Flowise API behind an internal network boundary or VPN to reduce the attacker pool. Note that network isolation alone does not protect against insider threats or compromised API credentials.
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today