CVE-2024-36420: high-severity vulnerability in FlowiseAI Flowise
GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file
Published · Updated
78Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 7.5epss 1.8%
from disclosure to weapon687 days
Published on NVDJul 1
1st PoC+687d
VulnCheck+746d
exploitation probability
1.8%top 22% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, the `/api/v1/openai-assistants-file` endpoint in `index.ts` is vulnerable to arbitrary file read due to lack of sanitization of the `fileName` body parameter. No known patches for this issue are available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
FlowiseAI · Flowisepublic PoCs found — 1
vulncheckvulncheck.com/xdb/2a21d58ccca9unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — FlowiseAI Flowise
In the same product, most dangerous first.
CVE-2025-59528CRITICALFlowise has Remote Code Execution vulnerabilityEPSS 86.2%CVE-2025-58434CRITICALFlowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account TakeoverEPSS 49.9%CVE-2024-8181CRITICALFlowise Authentication BypassEPSS 45.1%CVE-2025-50538HIGHCVE-2025-50538EPSS 14.0%CVE-2024-8182HIGHFlowise Denial of ServiceEPSS 13.9%CVE-2025-61913CRITICALFlowise is vulnerable to arbitrary file read, arbitrary file writeEPSS 13.0%