CVE-2025-71324

Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.

• CWE-73

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gfExploit, Vendor Advisory
• https://www.vulncheck.com/advisories/flowise-arbitrary-file-read-via-chatid-parameterThird Party Advisory
• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gfExploit, Vendor Advisory

Published

Jun 25, 2026

Last Modified

Jun 30, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-71319image-size through 2.0.2 contains a denial of service vulner…8.7
• CVE-2025-7132A vulnerability was found in Campcodes Payroll Management Sy…9.8
• CVE-2025-71320picklescan before 0.0.33 contains an incomplete deny-list th…9.8
• CVE-2025-71321picklescan before 0.0.33 contains an arbitrary file writing …9.8
• CVE-2025-71322PickleScan before 0.0.33 fails to include the pty.spawn func…8.8
• CVE-2025-71323picklescan before 0.0.33 fails to block the ctypes module, a…9.8
• CVE-2025-71325picklescan before 0.0.27 contains a parsing logic error in t…9.8
• CVE-2025-71326AVAST Antivirus 25.11 contains an unquoted service path vuln…8.5
• CVE-2025-71327Flowise contains an authentication bypass vulnerability in t…9.3
• CVE-2025-71328Flowise before 3.0.10 contains an unverified password change…8.8
• CVE-2025-71329image-size through 2.0.2 contains a denial of service vulner…8.7
• CVE-2025-7133A vulnerability classified as problematic has been found in …5.4