Flowise contains a critical vulnerability in its WriteFileTool that allows authenticated users to write arbitrary files to any location on the server's file system. This lack of path restriction can lead to remote command execution by overwriting sensitive files such as SSH authorized keys or system libraries. The vulnerability affects Flowise versions prior to 3.0.8 and has been confirmed in the latest Docker image. A fix is available in version 3.0.8.