Loading vulnerability…
Arbitrary File Read/Write in Flowise WriteFileTool and ReadFileTool
CVE-2025-61913 is a critical vulnerability in Flowise, a drag-and-drop interface for building customized large language model flows. In Flowise versions prior to 3.0.8, the WriteFileTool and ReadFileTool do not properly restrict file path access. As a result, an authenticated attacker can supply attacker-controlled paths and read from or write to arbitrary locations on the underlying filesystem outside any intended restricted directory. The issue is consistent with path traversal / improper pathname restriction behavior and affects remote deployments where these tools are exposed through Flowise functionality. Because arbitrary file write can be used to modify sensitive application, system, or user files, the vulnerability may be chained into remote command execution depending on the target environment and writable paths.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to read arbitrary files from the server filesystem and write arbitrary files to attacker-chosen paths. This can expose sensitive data such as configuration files, credentials, tokens, keys, and application secrets, and can also compromise integrity by overwriting or planting files used by the application or host. In environments where written files influence execution flow, startup behavior, authentication, or dynamic loading, the arbitrary write condition can be leveraged to achieve remote command execution. The published CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects high impact to confidentiality, integrity, and availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict or disable access to WriteFileTool and ReadFileTool, especially in agent flows available to untrusted or lower-trust users. Enforce strict allow-listing of readable and writable directories so file operations are confined to a dedicated working directory. Run Flowise with least privilege, preferably as a non-root user, and use hardening measures such as read-only filesystems where feasible, no unnecessary host mounts, and reduced container capabilities to limit the blast radius of arbitrary file access. Additional input validation and canonical path checks should be applied to file operation parameters.
Patch, then assume compromise.
Upgrade Flowise to version 3.0.8 or later, which fixes the vulnerable file path handling in WriteFileTool and ReadFileTool. Ensure all deployed Flowise-related packages and images are updated consistently, including Flowise, flowise, and flowise-components where applicable, and rebuild/redeploy Docker images from the fixed release. Validate that the patched version enforces path restrictions for file operations and review any custom integrations or forks for equivalent fixes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.