Description
Flowise on current main allows an authenticated user with documentStores:preview-process permission to trigger the S3 Directory
document loader with attacker-controlled S3 object keys.
Recommendation
Update the flowise-components package to the latest compatible version. Followings are version details:
- Affected version(s): <= 3.1.2
- Patched version(s): 3.1.3
References
Could your website be exposed too?
SmartScanner can check your website for Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys and gives you actionable findings to investigate.
Start a free scanRelated Issues
- obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/wr - Vulnerability
- Flowise is vulnerable to arbitrary file write through its WriteFileTool - CVE-2025-61913
- Flowise is vulnerable to arbitrary file exposure through its ReadFileTool - Vulnerability
- @saltcorn/server arbitrary file and directory listing when accessing build mobile app results - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated August 04, 2026