CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2025-71334 — Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary...

·Source: NIST NVD

Updated:

Executive Summary

Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToSt

Analysis

Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution. CVSS Score: 9.8. Published: 2026-06-25T22:16:59.127.

Indicators of Compromise (1)

CVE (1)
CVE-2025-71334
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 25, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

EIB issues DLT-native commercial paper on Clearstream platform

The European Investment Bank (EIB) has issued the first distributed ledger technology-native commercial paper on Clearstream’s D7 platform.

Finextra
MEDIUMVulnerability

Mastercard launches Africa Cybersecurity Centre of Excellence

Mastercard has unveiled a pan-African, multiyear initiative designed to strengthen cyber resilience across the continent.

Finextra
MEDIUMVulnerability

How Cloud Security Risks Grow With Home-Based Care

As hospital-at-home programs expand and AI adoption accelerates, healthcare organizations face mounting cloud security demands. Anahi Santiago, CISO of ChristianaCare, discusses vendor accountability, identity management, clinical AI risks and the need for stronger cybersecurity foundations.

Bank Info Security