CVE-2025-71324: Flowise path traversal leaks database

CISO Take

Flowise versions before 3.0.6 contain a path traversal flaw in two unauthenticated API endpoints where an unvalidated chatId parameter bypasses the storage-directory containment check via a fallback code path in streamStorageFile(), allowing remote attackers to read arbitrary server-side files with a single HTTP request. The most damaging default target is /root/.flowise/database.sqlite, which in standard deployments holds every stored AI service API key, user credential, system prompt, and workflow definition — complete database exfiltration with zero authentication. This CVE is not yet in CISA KEV and no public exploit has been released, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N profile means any internet-facing Flowise instance is trivially exploitable by opportunistic attackers, and the package's history of 112 CVEs signals a target that adversaries actively probe. Upgrade to Flowise 3.0.6 immediately, rotate all AI provider API keys stored in Flowise, and audit access logs for directory traversal patterns in chatId parameters on both affected endpoints.

Sources: NVD GitHub Advisory ATLAS VulnCheck

What is the risk?

High risk in practice despite the 7.5 CVSS score underselling the operational impact. The attack requires zero skill, zero authentication, and is executable from any network — a script-kiddie can download the entire Flowise database with a single curl command. Flowise is widely deployed as a no-code AI orchestration platform, and its database almost universally stores high-value secrets: OpenAI and Anthropic API keys with billing exposure, internal system prompts encoding business logic, and connection strings for vector stores and databases. The narrow pre-exploit remediation window is the only mitigating factor; post-disclosure this will be mass-scanned within days.

How does the attack unfold?

Discovery

Attacker identifies internet-facing Flowise instances via Shodan or Censys using API response fingerprints characteristic of the Flowise platform.

AML.T0006

Exploitation

Attacker sends unauthenticated HTTP request with a directory traversal payload in the chatId parameter to /api/v1/get-upload-file, bypassing the storage containment check via the unguarded fallback path in streamStorageFile().

AML.T0049

Data Collection

Server streams /root/.flowise/database.sqlite, giving the attacker the complete database including all AI provider API keys, credentials, system prompts, and workflow configurations stored by the application.

AML.T0037

Credential Abuse

Attacker extracts AI provider API keys and service credentials from the database and uses them to access connected LLM APIs, exfiltrate proprietary data, or launch cost-harvesting attacks at the victim's billing expense.

AML.T0055

Discovery

Attacker identifies internet-facing Flowise instances via Shodan or Censys using API response fingerprints characteristic of the Flowise platform.

AML.T0006

Exploitation

Attacker sends unauthenticated HTTP request with a directory traversal payload in the chatId parameter to /api/v1/get-upload-file, bypassing the storage containment check via the unguarded fallback path in streamStorageFile().

AML.T0049

Data Collection

Server streams /root/.flowise/database.sqlite, giving the attacker the complete database including all AI provider API keys, credentials, system prompts, and workflow configurations stored by the application.

AML.T0037

Credential Abuse

Attacker extracts AI provider API keys and service credentials from the database and uses them to access connected LLM APIs, exfiltrate proprietary data, or launch cost-harvesting attacks at the victim's billing expense.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

1.4%

chance of exploitation in 30 days

Higher than 70% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

✓ VulnCheck KEV (exploitation reported — broader/earlier than CISA) — Aug 2026

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

What should I do?

6 steps

Upgrade to Flowise 3.0.6 or later immediately — this is the only complete remediation.
If patching is delayed, block all external access to /api/v1/get-upload-file and /api/v1/openai-assistants-file/download at the WAF or reverse proxy layer as an emergency measure.
Assume compromise and rotate all AI service API keys (OpenAI, Anthropic, Mistral, etc.) stored in Flowise if the instance was internet-facing — do not wait for confirmation of exploitation.
Audit web server and application access logs for requests to the affected endpoints containing traversal sequences (../, %2e%2e%2f, and URL-encoded variants) in the chatId parameter, looking back at least 30 days.
Migrate credential storage from the Flowise database to environment variables or a dedicated secrets manager.
Restrict Flowise to internal networks; enforce authentication at the reverse proxy layer for any externally accessible deployment.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Extraction Auth Bypass Agent Framework AML.T0006 - Active Scanning AML.T0025 - Exfiltration via Cyber Means AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15(1) - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2.3 - AI System Security Controls

NIST AI RMF

MANAGE 2.4 - Residual Risks and Vulnerabilities Tracked

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2025-71324?

Flowise versions before 3.0.6 contain a path traversal flaw in two unauthenticated API endpoints where an unvalidated chatId parameter bypasses the storage-directory containment check via a fallback code path in streamStorageFile(), allowing remote attackers to read arbitrary server-side files with a single HTTP request. The most damaging default target is /root/.flowise/database.sqlite, which in standard deployments holds every stored AI service API key, user credential, system prompt, and workflow definition — complete database exfiltration with zero authentication. This CVE is not yet in CISA KEV and no public exploit has been released, but the CVSS:3.1 AV:N/AC:L/PR:N/UI:N profile means any internet-facing Flowise instance is trivially exploitable by opportunistic attackers, and the package's history of 112 CVEs signals a target that adversaries actively probe. Upgrade to Flowise 3.0.6 immediately, rotate all AI provider API keys stored in Flowise, and audit access logs for directory traversal patterns in chatId parameters on both affected endpoints.

Is CVE-2025-71324 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71324, increasing the risk of exploitation.

How to fix CVE-2025-71324?

1. Upgrade to Flowise 3.0.6 or later immediately — this is the only complete remediation. 2. If patching is delayed, block all external access to /api/v1/get-upload-file and /api/v1/openai-assistants-file/download at the WAF or reverse proxy layer as an emergency measure. 3. Assume compromise and rotate all AI service API keys (OpenAI, Anthropic, Mistral, etc.) stored in Flowise if the instance was internet-facing — do not wait for confirmation of exploitation. 4. Audit web server and application access logs for requests to the affected endpoints containing traversal sequences (../, %2e%2e%2f, and URL-encoded variants) in the chatId parameter, looking back at least 30 days. 5. Migrate credential storage from the Flowise database to environment variables or a dedicated secrets manager. 6. Restrict Flowise to internal networks; enforce authentication at the reverse proxy layer for any externally accessible deployment.

What systems are affected by CVE-2025-71324?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, LLM workflow orchestration, RAG pipelines, No-code AI builders.

What is the CVSS score for CVE-2025-71324?

CVE-2025-71324 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 1.38%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksLLM workflow orchestrationRAG pipelinesNo-code AI builders

MITRE ATLAS Techniques

AML.T0006 Active Scanning

AML.T0025 Exfiltration via Cyber Means

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15(1)

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.

Exploitation Scenario

An attacker scans Shodan or Censys for internet-facing Flowise instances identifiable by characteristic API response signatures. They send an unauthenticated GET request to /api/v1/get-upload-file?chatId=../../../../../../root/.flowise/database.sqlite (or a URL-encoded traversal equivalent) against the target. The chatId value is passed directly to streamStorageFile(), where the fallback file-lookup path — evaluated without orgId and after the storage containment check — fails to enforce directory boundaries, causing the server to stream back the full SQLite database. The attacker parses the database offline, extracting OpenAI and Anthropic API keys embedded in saved flow configurations, then uses these keys to exfiltrate proprietary data processed through the victim's agents, run inference at the victim's billing cost, or pivot to internal systems via database connection strings and tool credentials found in the same database.

Weaknesses (CWE)

CWE-73 External Control of File Name or Path Primary CWE-73 External Control of File Name or Path

CWE-73 — External Control of File Name or Path: The product allows user input to control or influence paths or file names that are used in filesystem operations.

[Architecture and Design] When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap provide this capability.
[Architecture and Design, Operation] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.