Threats tagged 'ghsa-w5r9-j49j-2m55'

Flowise versions 2.2.8 and earlier contain an arbitrary file access vulnerability due to missing validation of chatflowId and chatId parameters. An unauthenticated attacker can exploit this by supplying path-traversal values to write and read arbitrary files via specific API endpoints. This arbitrary file write capability may lead to remote code execution.