CVE-2026-56273
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Flowise before version 3.1.0 contains a path traversal vulnerability in the Faiss and SimpleStore vector store implementations. Authenticated users can supply an unsanitized basePath parameter, allowing vector store data to be written to arbitrary filesystem locations.
Risk Assessment
Attackers with valid API tokens can overwrite system files or inject malicious code, potentially leading to server compromise or data exfiltration.
Recommendation
Upgrade Flowise to version 3.1.0 or later immediately, which includes a fix for the path traversal vulnerability.
Original NVD description (English source)
Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated users. Attackers with valid API tokens can write vector store data to arbitrary filesystem locations, potentially enabling code execution or data exfiltration.