CVE-2025-61913: Arbitrary File Access in Flowise

The core of the vulnerability lies within the WriteFileTool component of Flowise, designed to handle large model files. Due to insufficient file path restrictions, an authenticated attacker can manipulate this tool to write files to any location on the server's file system. This is a significant risk because an attacker could overwrite critical system files, inject malicious code, or gain persistent access to the system. Successful exploitation could lead to complete system compromise, data exfiltration, and denial of service. The potential for remote command execution elevates the severity to critical, as it bypasses typical access controls.

1. Reserved2025-10-03
2. Published2025-10-09
3. Modified2026-02-04
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade Flowise to version 3.0.8 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the WriteFileTool component to only trusted users and processes. Implement strict file system permissions to limit the attacker's ability to write to sensitive directories. Consider using a Web Application Firewall (WAF) to filter requests containing potentially malicious file paths. Regularly monitor system logs for suspicious file access activity.