{"id":"GHSA-c3hj-m5hq-59xw","title":"Duplicate Advisory : Flowise allows arbitrary file write to RCE","summary":"Duplicate Advisory : Flowise allows arbitrary file write to RCE","severity":"critical","cvss":10,"cwe":["CWE-73"],"vendor":"flowise","product":"flowise","ecosystem":"npm","affected":["flowise <= 2.2.7"],"published":"2026-06-26","updated":"2026-11-03","sourceUpdated":"2026-11-03T17:36:50Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-c3hj-m5hq-59xw","references":[{"url":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71338"},{"url":"https://www.vulncheck.com/advisories/flowise-arbitrary-file-write-to-remote-code-execution-via-document-store-api"},{"url":"https://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.2.7-patch.1"},{"url":"https://github.com/advisories/GHSA-c3hj-m5hq-59xw"}],"tags":["ghsa","npm"],"ingestedAt":"2026-11-03T17:50:48.250Z","slug":"GHSA-c3hj-m5hq-59xw","body":"## Overview\n\n### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-8vvx-qvq9-5948. This link is maintained to preserve external references.\n\n### Original Description\n\nFlowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.\n\n## Affected packages\n\n- `flowise <= 2.2.7`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}