Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys

Description

Flowise on current main allows an authenticated user with documentStores:preview-process permission to trigger the S3 Directory
document loader with attacker-controlled S3 object keys.

Recommendation

Update the flowise-components package to the latest compatible version. Followings are version details:

• Affected version(s): <= 3.1.2
• Patched version(s): 3.1.3

References

• GHSA-88pr-878c-24wf
• CWE-22
• CWE-73
• OWASP 2021-A1
• OWASP 2021-A4

Related Issues

• obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/wr - Vulnerability
• Flowise is vulnerable to arbitrary file write through its WriteFileTool - CVE-2025-61913
• Flowise is vulnerable to arbitrary file exposure through its ReadFileTool - Vulnerability
• @saltcorn/server arbitrary file and directory listing when accessing build mobile app results - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

flowise-components