CVE-2026-56273

Flowise - Path Traversal in Vector Store basePath Parameter

CVSS 4.9 MEDIUMEPSS 0.3%CWE-22

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 4.9EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

08 jul 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated users. Attackers with valid API tokens can write vector store data to arbitrary filesystem locations, potentially enabling code execution or data exfiltration.

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N

Produtos afetados

Flowise · Flowise

Referências

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w6v6-49gh-mc9w https://www.vulncheck.com/advisories/flowise-path-traversal-in-vector-store-basepath-parameter