CVE-2025-71334: Flowise path traversal → RCE

CISO Take

Flowise before version 3.0.6 contains a critical path traversal vulnerability in its file handling endpoints that allows any unauthenticated attacker to read and write arbitrary files on the server by supplying directory traversal sequences as chatflowId parameters. With a CVSS score of 9.8 and the full AV:N/AC:L/PR:N/UI:N profile, this is as exploitable as vulnerabilities get — no credentials, no special knowledge, just an HTTP request to any exposed Flowise instance. The arbitrary file write primitive is a well-understood path to remote code execution, and given that Flowise instances typically store OpenAI, Anthropic, and other LLM provider API keys in configuration files, a successful read exploit alone results in significant credential exposure and unauthorized AI service usage at the victim's cost. Upgrade to Flowise 3.0.6 immediately; if immediate patching is not possible, take the instance offline or restrict it behind a VPN or network control until patched, and rotate all API keys stored on affected hosts.

Sources: NVD GitHub Advisory ATLAS vulncheck.com

What is the risk?

Critical. CVSS 9.8 with no authentication required, no user interaction, and a network-accessible attack vector makes this trivially weaponizable at scale. The compound impact of arbitrary file read (immediate credential exfiltration) and arbitrary file write (path to full RCE) means a single exposed Flowise instance represents a complete system compromise scenario. The package carries 112 prior CVEs, indicating a historically weak security posture. Any internet-facing Flowise deployment on versions 2.2.8 or earlier should be treated as actively compromised until patched.

How does the attack unfold?

Reconnaissance

Attacker identifies internet-facing Flowise instances via Shodan or Censys and confirms pre-3.0.6 version through response headers or UI fingerprinting.

AML.T0006

Initial Access

Attacker sends an unauthenticated GET to /api/v1/get-upload-file with a path traversal chatflowId (e.g., ../../../../.env) confirming arbitrary file read without any credentials.

AML.T0049

Credential Harvesting

Attacker reads environment and configuration files to extract LLM API keys (OpenAI, Anthropic), database credentials, and auth secrets stored on the Flowise host.

AML.T0055

Code Execution

Attacker POSTs a base64-encoded web shell via /api/v1/chatflows with a path traversal chatflowId targeting a web-writable directory, achieving full remote code execution and persistent host compromise.

AML.T0072

Reconnaissance

Attacker identifies internet-facing Flowise instances via Shodan or Censys and confirms pre-3.0.6 version through response headers or UI fingerprinting.

AML.T0006

Initial Access

Attacker sends an unauthenticated GET to /api/v1/get-upload-file with a path traversal chatflowId (e.g., ../../../../.env) confirming arbitrary file read without any credentials.

AML.T0049

Credential Harvesting

Attacker reads environment and configuration files to extract LLM API keys (OpenAI, Anthropic), database credentials, and auth secrets stored on the Flowise host.

AML.T0055

Code Execution

Attacker POSTs a base64-encoded web shell via /api/v1/chatflows with a path traversal chatflowId targeting a web-writable directory, achieving full remote code execution and persistent host compromise.

AML.T0072

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch
Flowise	npm	—	No patch

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

3.9%

chance of exploitation in 30 days

Higher than 89% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

✓ VulnCheck KEV (exploitation reported — broader/earlier than CISA) — Jun 2026

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

○ Nuclei detection template available

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Patch immediately: upgrade to Flowise 3.0.6+. 2) If patching is not immediately possible, take Flowise offline or restrict access to trusted IP ranges only — this is trivially exploitable with no tooling required. 3) WAF mitigation: block requests containing path traversal sequences (../, %2e%2e%2f, encoded variants) in chatflowId and chatId parameters across /api/v1/chatflows, /api/v1/get-upload-file, and /api/v1/openai-assistants-file/download endpoints. 4) Rotate all LLM API keys, database credentials, and secrets stored on affected Flowise hosts. 5) Review server access logs for the three affected endpoints, specifically looking for non-UUID, non-numeric, or path-containing chatflowId values as indicators of exploitation. 6) Audit all files in Flowise storage directories for unexpected or recently written content.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Extraction Auth Bypass Framework Agent API AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials AML.T0072 - Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - AI system security

NIST AI RMF

GOVERN 1.7 - Processes for AI risk management

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2025-71334?

Flowise before version 3.0.6 contains a critical path traversal vulnerability in its file handling endpoints that allows any unauthenticated attacker to read and write arbitrary files on the server by supplying directory traversal sequences as chatflowId parameters. With a CVSS score of 9.8 and the full AV:N/AC:L/PR:N/UI:N profile, this is as exploitable as vulnerabilities get — no credentials, no special knowledge, just an HTTP request to any exposed Flowise instance. The arbitrary file write primitive is a well-understood path to remote code execution, and given that Flowise instances typically store OpenAI, Anthropic, and other LLM provider API keys in configuration files, a successful read exploit alone results in significant credential exposure and unauthorized AI service usage at the victim's cost. Upgrade to Flowise 3.0.6 immediately; if immediate patching is not possible, take the instance offline or restrict it behind a VPN or network control until patched, and rotate all API keys stored on affected hosts.

Is CVE-2025-71334 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71334, increasing the risk of exploitation.

How to fix CVE-2025-71334?

1) Patch immediately: upgrade to Flowise 3.0.6+. 2) If patching is not immediately possible, take Flowise offline or restrict access to trusted IP ranges only — this is trivially exploitable with no tooling required. 3) WAF mitigation: block requests containing path traversal sequences (../, %2e%2e%2f, encoded variants) in chatflowId and chatId parameters across /api/v1/chatflows, /api/v1/get-upload-file, and /api/v1/openai-assistants-file/download endpoints. 4) Rotate all LLM API keys, database credentials, and secrets stored on affected Flowise hosts. 5) Review server access logs for the three affected endpoints, specifically looking for non-UUID, non-numeric, or path-containing chatflowId values as indicators of exploitation. 6) Audit all files in Flowise storage directories for unexpected or recently written content.

What systems are affected by CVE-2025-71334?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration platforms, chatbot deployments, RAG pipelines, no-code AI builders.

What is the CVSS score for CVE-2025-71334?

CVE-2025-71334 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 3.90%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration platformschatbot deploymentsRAG pipelinesno-code AI builders

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

AML.T0072 Reverse Shell

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: GOVERN 1.7

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.

Exploitation Scenario

An attacker performs passive reconnaissance on internet-facing Flowise instances via Shodan or Censys, identifying pre-3.0.6 deployments. Without any authentication, they issue a GET to /api/v1/get-upload-file?chatflowId=../../../../.env to immediately harvest OpenAI, Anthropic, and database credentials stored in the environment file. For RCE, they POST a base64-encoded PHP web shell to /api/v1/chatflows with chatflowId set to ../../../../var/www/html/shell.php, then trigger execution via the web server. From this foothold, the attacker exfiltrates all chatflow configurations, user conversation histories, and embedded documents, then pivots to connected databases and abuses the harvested AI provider API keys for unauthorized model access at the victim's expense. The entire attack chain requires no credentials, no prior knowledge of the target, and can be scripted in minutes.

Weaknesses (CWE)

CWE-73 External Control of File Name or Path Primary CWE-73 External Control of File Name or Path

CWE-73 — External Control of File Name or Path: The product allows user input to control or influence paths or file names that are used in filesystem operations.

[Architecture and Design] When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap provide this capability.
[Architecture and Design, Operation] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.