GHSA-c3hj-m5hq-59xw

Duplicate Advisory : Flowise allows arbitrary file write to RCE

Published

2026-06-26

Modified

2026-11-03

Sources

github-advisory

Summary

### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8vvx-qvq9-5948. This link is maintained to preserve external references. ### Original Description Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit unsanitized fileName parameters with ../ sequences to overwrite critical files like package.json and achieve remote code execution when the application restarts.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-c3hj-m5hq-59xw