The vulnerability in Flowise involves improper sanitization of the fileName parameter in the /api/v1/document-store/loader/process endpoint, enabling unauthenticated attackers to perform path traversal attacks. This allows them to write arbitrary files to the filesystem, including overwriting critical application files like package.json. Such overwrites can result in remote code execution upon application restart. The vulnerability is categorized under CWE-73 (External Control of File Name or Path). No patch or remediation information is currently available, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to write arbitrary files on the server filesystem, potentially overwriting critical files such as package.json. This can lead to remote code execution when the application restarts, posing a critical risk to system integrity and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious activity related to file writes. Avoid exposing the /api/v1/document-store/loader/process endpoint to untrusted networks.