CVE-2025-61913

Published Oct 8, 2025

Last updated 8 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-61913 affects Flowise, a drag-and-drop user interface for building customized large language model flows. Specifically, versions prior to 3.0.8 contain a vulnerability in the WriteFileTool and ReadFileTool components. These tools lack restrictions on file path access. Authenticated attackers can exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. The vulnerability exists because the WriteFileTool does not validate the file\_path parameter, allowing writing or overwriting any file on the host, including critical configuration files or system binaries. Flowise version 3.0.8 addresses this vulnerability.

Description: Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability.
Source: security-advisories@github.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.9
Impact score: 6
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-22

Hype score: Not currently trending

References