CVE-2025-61913 - CVE House
Back to Database
Status published Critical CVE-2025-61913

Flowise is vulnerable to arbitrary file read, arbitrary file write

Vulnerability Description

Flowise is a drag & drop user interface to build a customized large language model flow. In versions prior to 3.0.8, WriteFileTool and ReadFileTool in Flowise do not restrict file path access, allowing authenticated attackers to exploit this vulnerability to read and write arbitrary files to any path in the file system, potentially leading to remote command execution. Flowise 3.0.8 fixes this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-61913

Credits & Attribution

No credits recorded in the NVD database.

References

More from FlowiseAI

View All →
CVE-2025-61687
FlowiseAI/Flosise has File Upload vulnerability
High 8.3
CVE-2025-59528
Flowise has Remote Code Execution vulnerability
Critical 10
CVE-2025-59527
FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
High 7.5
CVE-2025-59434
Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function
Critical 9.6
CVE-2025-58434
Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
Critical 9.8

Affected Vendor

Affected Software

Flowise
Vulnerable Versions:
< 3.0.8

Timeline

Official Publish: October 8th, 2025
Last Modified: October 14th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact