CVE-2025-61913

Flowise is vulnerable to arbitrary file read, arbitrary file write

Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability.

Affected

FlowiseAI · Flowise

CVSS v3.1 NVD

9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

12.95% chance of exploitation in the next 30 days, 96th percentile

Published

2025-10-08

Updated

2025-10-14

Proof-of-concept exploits (1)

• advisories/GHSA-jv9m-vf54-chjj

Security advisories

• FlowiseAI/Flowise/security/advisories/GHSA-j44m-5v8f-gc9c
• FlowiseAI/Flowise/security/advisories/GHSA-jv9m-vf54-chjj
• FlowiseAI/Flowise/commit/1fb12cd93143592a18995f63b781d25b354d48a3

References

• CVE Record
• NVD entry