Flowise 1.4.3 - Arbitrary File Read

Flowise 1.4.3 contains a path traversal caused by lack of sanitization of 'fileName' parameter in /api/v1/openai-assistants-file endpoint in index.ts, letting attackers read arbitrary files, exploit requires attacker to send crafted request. id: CVE-2024-36420 info: name: Flowise 1.4.3 - Arbitrar...

POC_CVE-2024-36420

POCCVE-2024-36420 Local reproduction lab and nuclei template draft for CVE-2024-36420 affecting Flowise. Summary CVE-2024-36420 is an arbitrary file read in Flowise caused by unsanitized use of the fileName body parameter in: POST /api/v1/openai-assistants-file This lab was used to validate:...

Exploit for Injection in Flowiseai Flowise

POCCVE-2024-36420 Local reproduction lab and nuclei template...