973 matches found
Flowise 安全漏洞
Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in Flowise 2.2.3 and earlier versions that stems from an SQL injection in the tableName parameter of PostgresVectorStores...
CVE-2025-29189
Flowise = 2.2.3 is vulnerable to SQL Injection. via tableName parameter at PostgresVectorStores...
VulnCheck KEV: CVE-2025-26319
FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments...
Arbitrary File Upload
flowise is vulnerable to Arbitrary File Upload. The vulnerability is due to lack of access control in the whitelisted route /api/v1/attachments, allowing an unauthorized attacker to upload arbitrary files when storageType is set to local default...
GHSA-8VVX-QVQ9-5948 Flowise allows arbitrary file write to RCE
Summary An attacker could write files with arbitrary content to the filesystem via the /api/v1/document-store/loader/process API. An attacker can reach RCERemote Code Execution via file writing. Details All file writing functions in packages/components/src/storageUtils.ts are vulnerable. -...
Flowise 代码问题漏洞
Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in Flowise version 2.2.6 that stems from the presence of an arbitrary file upload issue...
PT-2025-9712
Name of the Vulnerable Software and Affected Versions FlowiseAI Flowise version 2.2.6 Description FlowiseAI Flowise version 2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments API endpoint. This allows unauthenticated attackers to upload malicious files, potentially...
CVE-2024-36420
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the /api/v1/openai-assistants-file endpoint in index.ts is vulnerable to arbitrary file read due to lack of sanitization of the fileName body parameter. No known patches for this...
CVE-2024-36421
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration unauthenticated,...
CVE-2024-9148
Flowise 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed 2.0.0...
CVE-2024-8182
An Unauthenticated Denial of Service DoS vulnerability exists in Flowise version 1.8.2 leading to a complete crash of the instance running a vulnerable version due to improper handling of user supplied input to the “/api/v1/get-upload-file” api endpoint...
CVE-2024-8181
An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality...
Flowise OverrideConfig security vulnerability
Impact Flowise allows developers to inject configuration into the Chainflow during execution through the overrideConfig option. This is supported in both the frontend web integration and the backend Prediction API. This has a range of fundamental issues that are a major security vulnerability...
GHSA-5CPH-WVM9-45GJ Flowise OverrideConfig security vulnerability
Impact Flowise allows developers to inject configuration into the Chainflow during execution through the overrideConfig option. This is supported in both the frontend web integration and the backend Prediction API. This has a range of fundamental issues that are a major security vulnerability...
VulnCheck KEV: CVE-2024-8181
An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality...
Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting
Flowise 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed 2.0.0...
GHSA-M5P9-XVXJ-64C8 Flowise and Flowise Chat Embed vulnerable to Stored Cross-site Scripting
Flowise 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed 2.0.0...
CVE-2024-9148
Flowise 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed 2.0.0...
Flowise 安全漏洞
Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in versions prior to Flowise 2.1.1 that stems from a lack of input cleanup, resulting in vulnerability to stored cross-site scripting attacks...
