Flowise - LFI (CVE-2025-71324)
Description
Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints. The chatId value is not validated and is passed to streamStorageFile(), where a fallback file-lookup path constructed without the orgId is evaluated after the storage-directory containment check, allowing path traversal beyond the intended storage directory. Unauthenticated attackers can read sensitive files such as /root/.flowise/database.sqlite, exposing all database content in the default configuration.
psychologyCrowdSec Analysis
CVE-2025-71324 is a high-severity arbitrary file read vulnerability in Flowise versions before 3.0.6. Unauthenticated remote attackers can exploit path traversal through file-download endpoints to access sensitive files outside the intended storage directory, including the default database containing Flowise configuration and application data.
CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-71324 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers exploit Flowise file-download endpoints, particularly /api/v1/get-upload-file and /api/v1/openai-assistants-file/download, by supplying traversal sequences such as /../../ in the chatId parameter. Successful exploitation can return arbitrary local files, including database.sqlite identified by the SQLite format 3 signature.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-06-25 |
| Rule Released | 2026-08-25 |