Path traversal in Flowise - #VU125542

Detailed vulnerability description

The vulnerability allows a remote attacker to read arbitrary files and cause a denial of service.

The vulnerability exists due to path traversal in the chatId parameter handling of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints when processing file download requests. A remote attacker can supply a crafted chatId value to read arbitrary files and cause a denial of service.

In the default configuration, exploitation can expose the local sqlite database and its contents. Knowledge of a valid chatflowId is required, and the advisory states that the /api/v1/vector/upsert/ endpoint may disclose one through a verbose error response.

Remediation

Sources

• https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf
• https://github.com/advisories/GHSA-99pg-hqvx-r4gf