Flowise is vulnerable to arbitrary file exposure through its ReadFileTool

Description

The ReadFileTool in Flowise does not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read arbitrary files from the file system, potentially leading to remote command execution.

Recommendation

Update the flowise-components package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.0.8
• Patched version(s): 3.0.8

References

• GHSA-j44m-5v8f-gc9c
• CWE-22
• OWASP 2021-A1

Related Issues

• Flowise is vulnerable to arbitrary file write through its WriteFileTool - CVE-2025-61913
• Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys - Vulnerability
• Trix has a stored XSS vulnerability through its attachment attribute - Vulnerability
• VvvebJs Arbitrary File Upload vulnerability - CVE-2024-29272

You might also like:

Is your robots.txt file vulnerable? Here's how to check and secure it

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

flowise-components