CVE-2025-61913

Katalog CVE

CVSS 9.9 · Critical EPSS 13,0%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada flowiseai flowise. Skor CVSS 3.1 9.9 (Critical) menurut NVD.

Deskripsi (NVD)

Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability.

Rincian

Terbit di NVD

8 Oktober 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

9.9 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

13,0% peluang dieksploitasi; lebih tinggi dari 96,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-j44m-5v8f-gc9c exploit · advisory vendor
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-jv9m-vf54-chjj exploit · advisory vendor
• https://github.com/FlowiseAI/Flowise/commit/1fb12cd93143592a18995f63b781d25b354d48a3 patch
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.8 release notes