CVE-2025-61913 CRITICAL

CVE-2025-61913: Flowise is vulnerable to arbitrary file read, arbitrary file write

Vendor Flowiseai
Product Flowise
Weakness CWE-22 · Path traversal
Published October 8, 2025
Last update October 14, 2025
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability.

Key dates

02Disclosure timeline

October 8, 2025 CVE published
October 14, 2025 Record updated