Vulnerability · Published Jun 25, 2026 · Assigned by VulnCheck

CVE-2025-71338Flowise through 2.2.7 - Arbitrary File Write to Remote Code Execution via document-store API

Critical 10.0

In plain English

A critical-severity security flaw in Flowise from Flowise. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)1.2%top 32.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the storage directory. Attackers can use parent-directory sequences to escape the storage directory and overwrite application files loaded at boot for remote code execution.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	flowise	no fix listed	GHSA-8vvx-qvq9-5948

Affected products (as reported)

Vendor	Product	Versions
Flowise	Flowise	0 – through 2.2.7

Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-8vvx-qvq9-5948) vendor-advisory
Flowise flowise%402.2.7-patch.1 Release Notes release-notes
VulnCheck Advisory: Flowise - Arbitrary File Write to Remote Code Execution via document-store API third-party-advisory