Flowise is vulnerable to arbitrary file write through its WriteFileTool

Description

The WriteFileTool in Flowise does not restrict the file path for reading, allowing authenticated attackers to exploit this vulnerability to write arbitrary files to any path in the file system, potentially leading to remote command execution.

Recommendation

Update the flowise-components package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.0.8
• Patched version(s): 3.0.8

References

• GHSA-jv9m-vf54-chjj
• CVE-2025-61913
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• Flowise is vulnerable to arbitrary file exposure through its ReadFileTool - Vulnerability
• @appium/support has a Zip Slip arbitrary file write in its ZIP extraction - CVE-2026-30973
• Flowise Vulnerable to SQL Injection via `tableName` Parameter - CVE-2025-29189
• DiracX-Web is vulnerable to attack through an Open Redirect on its login page - CVE-2025-54066

You might also like:

Is your robots.txt file vulnerable? Here's how to check and secure it

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

flowise-components