Flowise versions prior to 3.0.6 (including 2.2.8 and earlier) suffer an arbitrary file access flaw. The application fails to verify that the chatflowId and chatId parameters are UUIDs or numeric identifiers during file operations. By supplying a path‑traversal string such as '../../../../../tmp' as the chatflow ID, an unauthenticated attacker can exploit the /api/v1/chatflows endpoint, via the addBase64FilesToStorage function, to write files of their choosing, and can read arbitrary files through the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints, whose streamStorageFile function also ignores the validation. Writing files may enable remote code execution on the host system.

Affected vendors and products include Flowise, with the Flowise application in versions 2.2.8 and earlier containing the flaw. No other vendors are currently listed.

The CVSS score for this CVE is 9.3, indicating a critical severity. EPSS data are unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network‑based through exposed HTTP API endpoints, and the flaw can be exercised without authentication by directly invoking the vulnerable endpoints. Because the application does not validate the path supplied in the chatflow ID, the vulnerability is easily exploitable, especially for attackers who can transmit requests to a public Flowise deployment.