---
id: GHSA-c3hj-m5hq-59xw
title: 'Duplicate Advisory : Flowise allows arbitrary file write to RCE'
summary: 'Duplicate Advisory : Flowise allows arbitrary file write to RCE'
severity: critical
cvss: 10
cwe:
  - CWE-73
vendor: flowise
product: flowise
ecosystem: npm
affected:
  - flowise <= 2.2.7
published: '2026-06-26'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T17:36:50Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-c3hj-m5hq-59xw'
references:
  - url: >-
      https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8vvx-qvq9-5948
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-71338'
  - url: >-
      https://www.vulncheck.com/advisories/flowise-arbitrary-file-write-to-remote-code-execution-via-document-store-api
  - url: 'https://github.com/FlowiseAI/Flowise/releases/tag/flowise%402.2.7-patch.1'
  - url: 'https://github.com/advisories/GHSA-c3hj-m5hq-59xw'
tags:
  - ghsa
  - npm
ingestedAt: '2026-11-03T17:50:48.250Z'
---

## Overview

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-8vvx-qvq9-5948. This link is maintained to preserve external references.

### Original Description

Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.

## Affected packages

- `flowise <= 2.2.7`

## Remediation

Refer to the advisory for the patched release.