Threats tagged 'ghsa-c3hj-m5hq-59xw'

Flowise has a critical path traversal vulnerability in the /api/v1/document-store/loader/process endpoint. This flaw allows unauthenticated attackers to write arbitrary files to the filesystem by exploiting unsanitized fileName parameters containing ../ sequences. Successful exploitation can overwrite important files such as package.json, potentially enabling remote code execution upon application restart.