https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 21:13:39 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-254789 EUVD-2026-254789 https://cve.radiocsirt.org/vuln/euvd-2026-254789 https://cve.radiocsirt.org/vuln/fkie_cve-2025-61913 <p>Flowise is a drag &amp; drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability.</p> <p>Flowise is a drag &amp; drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-61913 https://cve.radiocsirt.org/vuln/ghsa-jv9m-vf54-chjj <p><strong>Affected:</strong> npm: flowise, npm: flowise-components</p> <p>### Summary</p> <p>The WriteFileTool in Flowise does not restrict the file path for reading, allowing authenticated attackers to exploit this vulnerability to write arbitrary files to any path in the file system, potentially leading to remote command execution.</p> <p>### Details</p> <p>Flowise supports providing WriteFileTool for large models, which is used to write files to the server&#39;s file system. The implementation of this tool is located at packages/components/nodes/tools/WriteFile/WriteFile.ts.</p> <p>``` /** * Class for writing data to files on the disk. Extends the StructuredTool * class. */ export class WriteFileTool extends StructuredTool { static lc_name() { return &#39;WriteFileTool&#39; }</p> <p>schema = z.object({ file_path: z.string().describe(&#39;name of file&#39;), text: z.string().describe(&#39;text to write to file&#39;) }) as any</p> <p>name = &#39;write_file&#39;</p> <p>description = &#39;Write file from disk&#39;</p> <p>store: BaseFileStore</p> <p>constructor({ store, ...rest }: WriteFileParams) { super(rest)</p> <p>this.store = store }</p> <p>async _call({ file_path, text }: z.infer&lt;typeof this.schema&gt;) { await this.store.writeFile(file_path, text) return &#39;File written to successfully.&#39; } }</p> <p>```</p> <p>This tool directly uses the file_path parameter passed to it without verifying whether the path belongs to Flowise&#39;s working directory. Authenticated attackers can exploit this vulnerability to write files with arbitrary content to any path on the server.</p> <p>Th…</p> <p><strong>Affected:</strong> npm: flowise, npm: flowise-components</p> <p>### Summary</p> <p>The WriteFileTool in Flowise does not restrict the file path for reading, allowing authenticated attackers to exploit this vulnerability to write arbitrary files to any path in the file system, potentially leading to remote command execution.</p> <p>### Details</p> <p>Flowise supports providing WriteFileTool for large models, which is used to write files to the server&#39;s file system. The implementation of this tool is located at packages/components/nodes/tools/WriteFile/WriteFile.ts.</p> <p>``` /** * Class for writing data to files on the disk. Extends the StructuredTool * class. */ export class WriteFileTool extends StructuredTool { static lc_name() { return &#39;WriteFileTool&#39; }</p> <p>schema = z.object({ file_path: z.string().describe(&#39;name of file&#39;), text: z.string().describe(&#39;text to write to file&#39;) }) as any</p> <p>name = &#39;write_file&#39;</p> <p>description = &#39;Write file from disk&#39;</p> <p>store: BaseFileStore</p> <p>constructor({ store, ...rest }: WriteFileParams) { super(rest)</p> <p>this.store = store }</p> <p>async _call({ file_path, text }: z.infer&lt;typeof this.schema&gt;) { await this.store.writeFile(file_path, text) return &#39;File written to successfully.&#39; } }</p> <p>```</p> <p>This tool directly uses the file_path parameter passed to it without verifying whether the path belongs to Flowise&#39;s working directory. Authenticated attackers can exploit this vulnerability to write files with arbitrary content to any path on the server.</p> <p>Th…</p> https://cve.radiocsirt.org/vuln/ghsa-jv9m-vf54-chjj https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2239 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Flowise ausnutzen, um Dateien zu manipulieren, und potenziell um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Flowise ausnutzen, um Dateien zu manipulieren, und potenziell um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2239