Flowise contains a path traversal flaw in the /api/v1/document-store/loader/process API. An unauthenticated attacker can supply a fileName parameter with '../' sequences to write arbitrary files to the underlying filesystem. By overwriting critical files such as package.json, the attacker can force the application to restart with malicious code, achieving remote code execution once the service reloads.

The Flowise Flowise platform is affected. No specific version data is listed, so all current releases are presumed vulnerable.

The vulnerability scores 10 on the CVSS scale, indicating the highest severity. The EPSS score is not available, but the absence of a KEV listing does not reduce the risk because the flaw allows unauthenticated writes to the filesystem, a classic server‑side path traversal. The likely attack vector is remote, via any unauthenticated HTTP request to the exposed API endpoint.