CVE-2026-56273 | THREATINT

Description

Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated users. Attackers with valid API tokens can write vector store data to arbitrary filesystem locations, potentially enabling code execution or data exfiltration.

PUBLISHED Reserved 2026-06-20 | Published 2026-07-08 | Updated 2026-07-09 | Assigner VulnCheck

MEDIUM: 4.9CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N

MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Problem types

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Product status

Default status

unaffected

Any version before 3.1.0

affected

3.1.0 (semver)

unaffected

Default status

unaffected

Any version before 3.1.0

affected

3.1.0 (semver)

unaffected

Credits

tenbbughunters reporter

References

github.com/...lowise/security/advisories/GHSA-w6v6-49gh-mc9w exploit

github.com/...lowise/security/advisories/GHSA-w6v6-49gh-mc9w (GitHub Security Advisory (GHSA-w6v6-49gh-mc9w)) vendor-advisory

www.vulncheck.com/...rsal-in-vector-store-basepath-parameter (VulnCheck Advisory: Flowise - Path Traversal in Vector Store basePath Parameter) third-party-advisory

cve.org (CVE-2026-56273)

nvd.nist.gov (CVE-2026-56273)

Download JSON