CVE-2025-71338

Katalog CVE

CVSS 9.8 · Critical EPSS 1,2%

Kerentanan External Control of File Name or Path pada flowiseai flowise. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

12 Oktober 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-73: External Control of File Name or Path

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948 exploit · advisory vendor
• https://www.vulncheck.com/advisories/flowise-arbitrary-file-write-to-remote-code-execution-via-document-store-... advisory pihak ketiga
• https://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.2.7-patch.1