Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Flowise 3.0.6 Clear all filters
TI-2025-43457 CVE-2025-71336 · GHSA-q2xp-j85q-883h

Flowise - Unsandboxed Remote Code Execution via Custom MCP

Priority HIGH 81

Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which is designed to execute OS commands such as launching local M…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01148 Published 2026-06-25 Fixed in 3.0.6 CWE-78
TI-2025-43455 CVE-2025-71334 · GHSA-w5r9-j49j-2m55

Flowise - Arbitrary File Access via Missing Chat Flow ID Validation

Priority HIGH 81

Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0436 Published 2026-06-25 Fixed in 3.0.6 CWE-73
TI-2025-43445 CVE-2025-71324 · GHSA-4pwq-xw7j-m297

Flowise - Arbitrary File Read via chatId Parameter

Priority HIGH 77

Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0157 Published 2026-06-25 Fixed in 3.0.6 CWE-73