Vulnerability · Published Jul 8, 2026 · Assigned by VulnCheck

CVE-2026-56273Flowise - Path Traversal in Vector Store basePath Parameter

Medium 6.5

In plain English

A medium-severity path traversal in Flowise from Flowise. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 56.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated users. Attackers with valid API tokens can write vector store data to arbitrary filesystem locations, potentially enabling code execution or data exfiltration.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	flowise	3.1.0	GHSA-w6v6-49gh-mc9w
npm	flowise-components	3.1.0	GHSA-w6v6-49gh-mc9w

Affected products (as reported)

Vendor	Product	Versions
Flowise	Flowise	0 – before 3.1.0
Flowise	Flowise	0 – before 3.1.0

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

GitHub Security Advisory (GHSA-w6v6-49gh-mc9w) vendor-advisory
VulnCheck Advisory: Flowise - Path Traversal in Vector Store basePath Parameter third-party-advisory