CVE-2025-71338: Flowise unauthenticated file

CISO Take

CVE-2025-71338 is a CVSS 10.0 path traversal vulnerability in Flowise's document-store loader API that allows any unauthenticated, network-accessible attacker to write arbitrary files to the server filesystem — no credentials, no user interaction, no exploitation complexity required. Flowise is widely deployed as an AI agent orchestration and workflow automation platform, meaning a successful attack can compromise the entire AI pipeline: LLM API keys, vector database credentials, agent configurations, and proprietary workflow logic all become accessible post-exploitation. The specific overwrite-package.json-then-RCE-on-restart chain is a well-understood exploitation primitive that threat actors weaponize rapidly, and with 112 prior CVEs in the same package the attack surface is well-catalogued. Immediately isolate all Flowise instances behind VPN or firewall rules blocking public access, audit filesystem integrity especially for package.json modifications, and apply available patches from GHSA-8vvx-qvq9-5948; if patching is not immediately possible, block the `/api/v1/document-store/loader/process` endpoint at the WAF or reverse proxy layer.

Sources: NVD GitHub Advisory VulnCheck ATLAS

What is the risk?

Maximum exploitability rating. The CVSS 10.0 vector (AV:N/AC:L/PR:N/UI:N/S:C) reflects zero barriers to exploitation: network-reachable, no auth, no complexity, scope changed meaning blast radius extends beyond the Flowise process itself. The path traversal primitive (CWE-73) is trivially exploitable by any attacker with HTTP access — no AI/ML knowledge required. Organizations running Flowise for internal AI automation may believe they are protected by network segmentation, but cloud-native deployments and misconfigured ingress rules frequently expose these instances. With 112 prior CVEs in the Flowise package, this target is actively monitored by researchers and threat actors alike.

How does the attack unfold?

Reconnaissance

Adversary uses Shodan, Censys, or active HTTP probing to identify publicly exposed Flowise instances on default port 3000 or behind reverse proxies.

AML.T0006

Unauthenticated File Write

Adversary sends a crafted unauthenticated POST to /api/v1/document-store/loader/process with a fileName parameter containing ../ path traversal sequences to overwrite package.json with a malicious version embedding an RCE payload.

AML.T0049

RCE via Application Restart

Adversary triggers or waits for Flowise to restart; on startup npm executes the malicious postinstall hook in the overwritten package.json, establishing a reverse shell with the Flowise process privileges.

AML.T0072

Credential Harvest and Lateral Movement

Adversary extracts LLM API keys, vector database credentials, and AI workflow configurations from the compromised Flowise environment, pivoting to connected AI infrastructure and downstream services.

AML.T0083

Reconnaissance

Adversary uses Shodan, Censys, or active HTTP probing to identify publicly exposed Flowise instances on default port 3000 or behind reverse proxies.

AML.T0006

Unauthenticated File Write

Adversary sends a crafted unauthenticated POST to /api/v1/document-store/loader/process with a fileName parameter containing ../ path traversal sequences to overwrite package.json with a malicious version embedding an RCE payload.

AML.T0049

RCE via Application Restart

Adversary triggers or waits for Flowise to restart; on startup npm executes the malicious postinstall hook in the overwritten package.json, establishing a reverse shell with the Flowise process privileges.

AML.T0072

Credential Harvest and Lateral Movement

Adversary extracts LLM API keys, vector database credentials, and AI workflow configurations from the compromised Flowise environment, pivoting to connected AI infrastructure and downstream services.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch
Flowise	npm	—	No patch

How severe is it?

CVSS 3.1

10.0 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 55% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C High

I High

A High

What should I do?

6 steps

IMMEDIATE

Restrict network access to all Flowise instances — place behind VPN, restrict ingress at firewall/load balancer to trusted IP ranges only.
AUDIT

Check filesystem integrity for unexpected modifications, specifically scanning for changes to package.json, node_modules, and configuration files; review Flowise access logs for POST requests to /api/v1/document-store/loader/process containing ../ sequences.
PATCH

Apply the fix referenced in GHSA-8vvx-qvq9-5948 as soon as a patched version is available; pin to the patched version in package.json/lockfile.
WORKAROUND

If patching is not immediately possible, block the /api/v1/document-store/loader/process endpoint at the WAF or reverse proxy layer.
CREDENTIAL ROTATION

Rotate all API keys, database passwords, and secrets accessible to the Flowise environment as a precaution.
DETECTION

Monitor for unexpected Flowise process restarts (potential RCE trigger) and alert on any file write operations outside expected paths using file integrity monitoring (FIM) tools.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Supply Chain Agent Framework Plugin AML.T0006 - Active Scanning AML.T0049 - Exploit Public-Facing Application AML.T0072 - Reverse Shell AML.T0081 - Modify AI Agent Configuration AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Information security for AI systems

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place to sustain the value of AI systems over time

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2025-71338?

CVE-2025-71338 is a CVSS 10.0 path traversal vulnerability in Flowise's document-store loader API that allows any unauthenticated, network-accessible attacker to write arbitrary files to the server filesystem — no credentials, no user interaction, no exploitation complexity required. Flowise is widely deployed as an AI agent orchestration and workflow automation platform, meaning a successful attack can compromise the entire AI pipeline: LLM API keys, vector database credentials, agent configurations, and proprietary workflow logic all become accessible post-exploitation. The specific overwrite-package.json-then-RCE-on-restart chain is a well-understood exploitation primitive that threat actors weaponize rapidly, and with 112 prior CVEs in the same package the attack surface is well-catalogued. Immediately isolate all Flowise instances behind VPN or firewall rules blocking public access, audit filesystem integrity especially for package.json modifications, and apply available patches from GHSA-8vvx-qvq9-5948; if patching is not immediately possible, block the `/api/v1/document-store/loader/process` endpoint at the WAF or reverse proxy layer.

Is CVE-2025-71338 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2025-71338, increasing the risk of exploitation.

How to fix CVE-2025-71338?

1. IMMEDIATE: Restrict network access to all Flowise instances — place behind VPN, restrict ingress at firewall/load balancer to trusted IP ranges only. 2. AUDIT: Check filesystem integrity for unexpected modifications, specifically scanning for changes to package.json, node_modules, and configuration files; review Flowise access logs for POST requests to /api/v1/document-store/loader/process containing ../ sequences. 3. PATCH: Apply the fix referenced in GHSA-8vvx-qvq9-5948 as soon as a patched version is available; pin to the patched version in package.json/lockfile. 4. WORKAROUND: If patching is not immediately possible, block the /api/v1/document-store/loader/process endpoint at the WAF or reverse proxy layer. 5. CREDENTIAL ROTATION: Rotate all API keys, database passwords, and secrets accessible to the Flowise environment as a precaution. 6. DETECTION: Monitor for unexpected Flowise process restarts (potential RCE trigger) and alert on any file write operations outside expected paths using file integrity monitoring (FIM) tools.

What systems are affected by CVE-2025-71338?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, LLM workflow automation, RAG pipelines, Document processing pipelines, Multi-agent orchestration systems.

What is the CVSS score for CVE-2025-71338?

CVE-2025-71338 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.86%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksLLM workflow automationRAG pipelinesDocument processing pipelinesMulti-agent orchestration systems

MITRE ATLAS Techniques

AML.T0006 Active Scanning

AML.T0049 Exploit Public-Facing Application

AML.T0072 Reverse Shell

AML.T0081 Modify AI Agent Configuration

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM05, LLM07

What are the technical details?

Original Advisory

Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.

Exploitation Scenario

An adversary performs passive recon using Shodan or Censys to enumerate publicly exposed Flowise instances (port 3000 or behind common reverse proxy patterns). Without any authentication, they craft a multipart POST request to `/api/v1/document-store/loader/process` with the `fileName` parameter set to `../../../../opt/flowise/package.json`, replacing the legitimate package.json with a malicious version containing a `postinstall` script that executes a reverse shell. The attacker then triggers a Flowise restart — either by waiting for a scheduled restart, sending crafted requests that cause an OOM condition, or exploiting another DoS vector in one of the 112 prior Flowise CVEs. On restart, npm executes the malicious postinstall hook, establishing a reverse shell that gives the attacker full control of the host, access to all stored LLM API credentials, and a pivot point into connected AI infrastructure.

Weaknesses (CWE)

CWE-73 External Control of File Name or Path Primary CWE-73 External Control of File Name or Path

CWE-73 — External Control of File Name or Path: The product allows user input to control or influence paths or file names that are used in filesystem operations.

[Architecture and Design] When the set of filenames is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap provide this capability.
[Architecture and Design, Operation] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict all access to files within a particular directory. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.