Description
The ReadFileTool in Flowise does not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read arbitrary files from the file system, potentially leading to remote command execution.
Recommendation
Update the flowise-components package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.0.8
- Patched version(s): 3.0.8
References
Could your website be exposed too?
SmartScanner can check your website for Flowise is vulnerable to arbitrary file exposure through its ReadFileTool and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Flowise is vulnerable to arbitrary file write through its WriteFileTool - CVE-2025-61913
- Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys - Vulnerability
- Trix has a stored XSS vulnerability through its attachment attribute - Vulnerability
- VvvebJs Arbitrary File Upload vulnerability - CVE-2024-29272
You might also like:
See something that needs correcting? Let us knowUpdated February 03, 2026