https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 22:35:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330521 EUVD-2026-330521 https://cve.radiocsirt.org/vuln/euvd-2026-330521 https://cve.radiocsirt.org/vuln/fkie_cve-2025-71334 <p>Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., &#39;../../../../../tmp&#39;) as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.</p> <p>Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., &#39;../../../../../tmp&#39;) as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-71334 https://cve.radiocsirt.org/vuln/ghsa-w5r9-j49j-2m55 <p>Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., &#39;../../../../../tmp&#39;) as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.</p> <p>Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., &#39;../../../../../tmp&#39;) as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution.</p> https://cve.radiocsirt.org/vuln/ghsa-w5r9-j49j-2m55 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2055 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Flowise ausnutzen, um Dateien zu manipulieren</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Flowise ausnutzen, um Dateien zu manipulieren</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2055