CVE-2026-12821: Flowise path traversal

CISO Take

CVE-2026-12821 is a path traversal flaw in Flowise's S3 Document Loader node (packages/components/nodes/documentloaders/S3/S3.ts) that allows any authenticated user to manipulate S3 object key paths and read files outside the intended bucket prefix. With a CVSS temporal metric indicating a proof-of-concept exists (E:P) and the attack requiring only low-privilege authentication — a realistic bar in any shared Flowise deployment — the practical exploitation risk exceeds what the medium severity label alone suggests, particularly given that Flowise's S3 loader is routinely used to ingest proprietary documents, fine-tuning corpora, prompt templates, and potentially credential files into RAG pipelines where exposure is disproportionately impactful. The vendor did not respond to disclosure, leaving patch status unknown for all Flowise releases up to 3.1.2 with no confirmed remediation version available. Until a patch is released, restrict S3 Document Loader access to trusted operators, enforce IAM prefix-scoped bucket policies, and monitor AWS CloudTrail for GetObject requests with path traversal sequences in the object key.

Sources: NVD ATLAS VulDB

What is the risk?

Medium risk with elevated concern for AI/ML pipeline operators. The CVSS 6.3 score reflects a network-exploitable, low-complexity vulnerability requiring only low privileges — a realistic attacker threshold for any Flowise user account in a shared or multi-tenant deployment. The CVSS temporal E:P indicator suggests a proof-of-concept exists despite the structured 'Public Exploit Available: No' field, warranting closer monitoring of exploit maturation. Flowise's track record of 95 CVEs in this package indicates a consistently broad attack surface. Vendor non-response to disclosure removes the option of coordinated patch timing, increasing window of exposure. Deployments with the S3 loader exposed to internal users or internet-facing instances carry the highest risk.

How does the attack unfold?

Initial Access

Adversary authenticates to a Flowise instance with a low-privilege account — obtained via insider access, credential theft, or a shared team account — gaining access to the workflow canvas or REST API.

AML.T0012

Exploitation

Adversary configures an S3 Document Loader node with a crafted object key containing path traversal sequences (e.g., '../../secrets/prod.env'), targeting files outside the intended S3 bucket prefix.

AML.T0049

Data Collection

Flowise constructs the S3 GetObject request using the unsanitized key, retrieves the targeted file, and injects its contents as document context into the AI pipeline.

AML.T0037

Exfiltration

Sensitive content — credentials, proprietary documents, API keys — surfaces in LLM chat output, Flowise execution logs, or API responses, enabling the adversary to extract and exploit the data.

AML.T0025

Initial Access

Adversary authenticates to a Flowise instance with a low-privilege account — obtained via insider access, credential theft, or a shared team account — gaining access to the workflow canvas or REST API.

AML.T0012

Exploitation

Adversary configures an S3 Document Loader node with a crafted object key containing path traversal sequences (e.g., '../../secrets/prod.env'), targeting files outside the intended S3 bucket prefix.

AML.T0049

Data Collection

Flowise constructs the S3 GetObject request using the unsanitized key, retrieves the targeted file, and injects its contents as document context into the AI pipeline.

AML.T0037

Exfiltration

Sensitive content — credentials, proprietary documents, API keys — surfaces in LLM chat output, Flowise execution logs, or API responses, enabling the adversary to extract and exploit the data.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Flowise	npm	—	No patch

Do you use Flowise? You're affected.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I Low

A Low

What should I do?

6 steps

Monitor FlowiseAI GitHub releases for a version beyond 3.1.2 that addresses CWE-22 in the S3 Document Loader and upgrade immediately upon availability.
Apply AWS IAM bucket policies restricting S3 GetObject operations to the specific prefixes Flowise legitimately requires — deny access to all other keys at the bucket policy level.
Disable or remove the S3 Document Loader node in Flowise deployments where it is not operationally required.
Enable and audit AWS CloudTrail S3 data events for GetObject requests containing traversal patterns ('../', '%2e%2e', double-dot sequences) in the object key field.
Restrict Flowise user roles so only administrators can configure document loader nodes; prevent general users from modifying S3 object key parameters.
If Flowise is internet-facing or accessible to untrusted internal users, consider temporarily disabling S3 loader functionality via Flowise's node configuration or placing the instance behind stricter authentication until a vendor patch is confirmed.

How is it classified?

Data Extraction Data Leakage Agent RAG Framework AML.T0025 - Exfiltration via Cyber Means AML.T0036 - Data from Information Repositories AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application AML.T0085 - Data from AI Services

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 9 - Risk management system

ISO 42001

A.8.1 - AI system inputs and data quality

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place to inventory AI risks and their impacts

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-12821?

CVE-2026-12821 is a path traversal flaw in Flowise's S3 Document Loader node (packages/components/nodes/documentloaders/S3/S3.ts) that allows any authenticated user to manipulate S3 object key paths and read files outside the intended bucket prefix. With a CVSS temporal metric indicating a proof-of-concept exists (E:P) and the attack requiring only low-privilege authentication — a realistic bar in any shared Flowise deployment — the practical exploitation risk exceeds what the medium severity label alone suggests, particularly given that Flowise's S3 loader is routinely used to ingest proprietary documents, fine-tuning corpora, prompt templates, and potentially credential files into RAG pipelines where exposure is disproportionately impactful. The vendor did not respond to disclosure, leaving patch status unknown for all Flowise releases up to 3.1.2 with no confirmed remediation version available. Until a patch is released, restrict S3 Document Loader access to trusted operators, enforce IAM prefix-scoped bucket policies, and monitor AWS CloudTrail for GetObject requests with path traversal sequences in the object key.

Is CVE-2026-12821 actively exploited?

No confirmed active exploitation of CVE-2026-12821 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-12821?

1. Monitor FlowiseAI GitHub releases for a version beyond 3.1.2 that addresses CWE-22 in the S3 Document Loader and upgrade immediately upon availability. 2. Apply AWS IAM bucket policies restricting S3 GetObject operations to the specific prefixes Flowise legitimately requires — deny access to all other keys at the bucket policy level. 3. Disable or remove the S3 Document Loader node in Flowise deployments where it is not operationally required. 4. Enable and audit AWS CloudTrail S3 data events for GetObject requests containing traversal patterns ('../', '%2e%2e', double-dot sequences) in the object key field. 5. Restrict Flowise user roles so only administrators can configure document loader nodes; prevent general users from modifying S3 object key parameters. 6. If Flowise is internet-facing or accessible to untrusted internal users, consider temporarily disabling S3 loader functionality via Flowise's node configuration or placing the instance behind stricter authentication until a vendor patch is confirmed.

What systems are affected by CVE-2026-12821?

This vulnerability affects the following AI/ML architecture patterns: RAG pipelines, agent frameworks, document ingestion pipelines.

What is the CVSS score for CVE-2026-12821?

CVE-2026-12821 has a CVSS v3.1 base score of 6.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

RAG pipelinesagent frameworksdocument ingestion pipelines

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0036 Data from Information Repositories

AML.T0037 Data from Local System

AML.T0049 Exploit Public-Facing Application

AML.T0085 Data from AI Services

Compliance Controls Affected

EU AI Act: Art. 9

ISO 42001: A.8.1

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

A vulnerability was determined in FlowiseAI Flowise up to 3.1.2. The impacted element is an unknown function of the file packages/components/nodes/documentloaders/S3/S3.ts of the component S3 Document Loader. Executing a manipulation can lead to path traversal. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Exploitation Scenario

An adversary holding a low-privilege Flowise account — a malicious insider, a compromised shared service account, or a trial user on a multi-tenant deployment — opens the Flowise canvas and adds an S3 Document Loader node or directly calls the Flowise API to trigger a flow containing one. Instead of providing a legitimate S3 object key, they craft a traversal payload such as '../../sensitive-configs/prod.env' or '../../.aws/credentials'. Flowise's S3.ts handler constructs the AWS GetObject request using the unsanitized key, successfully retrieves the targeted file from the connected bucket, and returns its contents as document context to the LLM node downstream. The file contents — which may include database connection strings, API keys, model weights references, or proprietary document collections — appear in the LLM's context window and can be extracted via chat output, logged in Flowise's execution history, or used by the adversary to mount further attacks against connected infrastructure.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.