CVE-2025-59527 - CVE House
Back to Database
Status published High CVE-2025-59527

FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability

Vulnerability Description

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery (SSRF) vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise server as a proxy to access internal network web services and explore their link structures. This issue has been patched in version 3.0.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59527

Credits & Attribution

No credits recorded in the NVD database.

References

More from FlowiseAI

View All →
CVE-2025-61913
Flowise is vulnerable to arbitrary file read, arbitrary file write
Critical 10
CVE-2025-61687
FlowiseAI/Flosise has File Upload vulnerability
High 8.3
CVE-2025-59528
Flowise has Remote Code Execution vulnerability
Critical 10
CVE-2025-59434
Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function
Critical 9.6
CVE-2025-58434
Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
Critical 9.8

Affected Vendor

Affected Software

Flowise
Vulnerable Versions:
= 3.0.5

Timeline

Official Publish: September 22nd, 2025
Last Modified: September 22nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-918

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1046 Network Service Discovery
Discovery