Advisoriesby IbisFlowise: arbitrary file write
Summary
Flowise on current main allows an authenticated user with
documentStores:preview-process permission to trigger the S3 Directory
document loader with attacker-controlled S3 object keys. The loader joins
each returned S3 key with a temporary directory using path.join(tempDir, key)
and writes the object bytes to disk **without validating traversal sequences
such as ../**. Cleanup later removes only the original temporary directory,
so files written outside that directory persist on the host filesystem.
This yields arbitrary file write with the privileges of the Flowise
server process.
A related variant exists in the S3File loader when
fileProcessingMethod = unstructured (same root cause; its cleanup behavior
turns it into a mixed arbitrary write/delete/DoS primitive).
## Affected component
packages/components/nodes/documentloaders/S3Directory/S3Directory.ts- line 191:
filePath = path.join(tempDir, key)(unsanitized) - line 213: recursive
mkdirSynccreates parent path - line 216:
writeFileSyncwrites attacker-controlled bytes - line 289: cleanup only removes the original
tempDir, so escaped
files remain on disk
- Related (variant):
packages/components/nodes/documentloaders/S3File/S3File.ts
(lines 756, 780, 782, 817 , arbitrary write + recursive dirname...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| flowise npm | < 3.1.3 | 3.1.3 |
Details and references
## Summary Flowise on current `main` allows an authenticated user with `documentStores:preview-process` permission to trigger the `S3 Directory` document loader with attacker-controlled S3 object keys. The loader joins each returned S3 key with a temporary directory using `path.join(tempDir, key)` and writes the object bytes to disk **without validating traversal sequences such as `../`**. Cleanup later removes only the original temporary directory, so files written outside that directory persist on the host filesystem. This yields **arbitrary file write** with the privileges of the Flowise server process. A related variant exists in the `S3File` loader when `fileProcessingMethod = unstructured` (same root cause; its cleanup behavior turns it into a mixed arbitrary write/delete/DoS primitive). ## Affected component - `packages/components/nodes/documentloaders/S3Directory/S3Directory.ts` - line **191**: `filePath = path.join(tempDir, key)` (unsanitized) - line **213**: recursive `mkdirSync` creates parent path - line **216**: `writeFileSync` writes attacker-controlled bytes - line **289**: cleanup only removes the original `tempDir`
More Flowise advisories
All Flowise
Flowise: information disclosureCVE-2026-70478fixed in 3.1.3Flowise: CSV Agent Prompt Injection Remote Code Execution VulnerabilityCVE-2026-70477fixed in 3.1.3Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing ManipulationCVE-2026-70476fixed in 3.1.3Flowise: missing authorizationCVE-2026-73603fixed in 3.1.4Flowise: Missing Authorization on Execution Update EndpointCVE-2026-70475fixed in 3.1.3Flowise: Cross-Workspace OAuth2 Credential Metadata LeakCVE-2026-70474fixed in 3.1.3