Executive Summary

This vulnerability exists in Flowise at the /api/v1/document-store/loader/process endpoint. It is a path traversal flaw that allows unauthenticated attackers to write arbitrary files to the filesystem.

Attackers exploit unsanitized fileName parameters containing ../ sequences to overwrite critical files such as package.json.

By overwriting these files, attackers can achieve remote code execution when the application restarts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including complete system compromise.

• Unauthenticated attackers can write arbitrary files to the system.
• Critical files like package.json can be overwritten.
• Remote code execution can be achieved when the application restarts, allowing attackers to run malicious code.
• This can lead to loss of confidentiality, integrity, and availability of the affected system.

Useful 0 Not Useful 0