Flowise is vulnerable to arbitrary file exposure through its ReadFileTool

### Summary The ReadFileTool in Flowise does not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read arbitrary files from the file system, potentially leading to remote command execution. ### Details Flowise supports providing ReadFileTool for large models to read files in the server's file system. The implementation of this tool is located at packages/components/nodes/tools/ReadFile/ReadFile.ts. ``` /** * Class for reading files from the disk. Extends the StructuredTool * class. */ export class ReadFileTool extends StructuredTool { static lc_name() { return 'ReadFileTool' } schema = z.object({ file_path: z.string().describe('name of file') }) as any name = 'read_file' description = 'Read file from disk' store: BaseFileStore constructor({ store }: ReadFileParams) { super(...arguments) this.store = store } async _call({ file_path }: z.infer<typeof this.schema>) { return await this.store.readFile(file_path) } } ``` The tool directly uses the file_path parameter passed to it without verifying whether the path belongs to Flowise's working directory. Authenticated attackers can exploit this vulnerability to read any known file on the server. For example, if the victim deploys in a Docker environment, the attacker could attempt to read sensitive files such as /root/.flowise/encryption.key, /root/.flowise/database.sqlite, and obtain sensitive information. If the victim does not use a Docker environment for deployment, the attacker could try reading sensitive files like /etc/passwd, /etc/shadow, /root/.ssh/id_rsa, further achieving the effect of remote command execution. ### PoC This file reading vulnerability has been verified to exist in the latest Flowise Docker image (https://hub.docker.com/layers/flowiseai/flowise/latest/images/sha256-26300377397818a451e0710389eb77615256b0f3ecc895194850ab35dda3ae7b). The reproduction steps are as follows: 1. Pull the Flowise Docker image ``` docker pull flowiseai/flowise ``` 2. Start the Flowise service ``` docker run -d --name flowise -p 3000:3000 flowise ``` 3. Access the Flowise service at server ip:3000 in the browser and register an account 4. Save the following content as agent.json ``` { "nodes": [ { "id": "startAgentflow_0", "type": "agentFlow", "position": { "x": -203, "y": 37 }, "data": { "id": "startAgentflow_0", "label": "Start", "version": 1.1, "name": "startAgentflow", "type": "Start", "color": "#7EE787", "hideInput": true, "baseClasses": [ "Start" ], "category": "Agent Flows", "description": "Starting point of the agentflow", "inputParams": [ { "label": "Input Type", "name": "startInputType", "type": "options", "options": [ { "label": "Chat Input", "name": "chatInput", "description": "Start the conversation with chat input" }, { "label": "Form Input", "name": "formInput", "description": "Start the workflow with form inputs" } ], "default": "chatInput", "id": "startAgentflow_0-input-startInputType-options", "display": true }, { "label": "Form Title", "name": "formTitle", "type": "string", "placeholder": "Please Fill Out The Form", "show": { "startInputType": "formInput" }, "id": "startAgentflow_0-input-formTitle-string", "display": false }, { "label": "Form Description", "name": "formDescription", "type": "string", "placeholder

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Severity from

GitHub (reviewed advisory)

Weakness

CWE-22

• github.com/FlowiseAI/Flowise/security/advisories/GHSA-j44m-5v8f-gc9c
• github.com/FlowiseAI/Flowise/security/advisories/GHSA-jv9m-vf54-chjj
• nvd.nist.gov/vuln/detail/CVE-2025-61913
• github.com/FlowiseAI/Flowise/commit/1fb12cd93143592a18995f63b781d25b354d48a3
• github.com/FlowiseAI/Flowise
• github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.8