Description
攻击者可构造恶意 chatId 参数（如 ../../）绕过路径校验机制，读取服务器本地任意文件。
Flowise 任意文件读取漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-99pg-hqvx-r4gf
https://cloud.tencent.com/developer/article/2579672
https://adg.csdn.net/69524b835b9f5f31781b68fd.html
https://nvd.nist.gov/vuln/detail/CVE-2025-61913
https://zhuanlan.zhihu.com/p/1888633779427443826
https://blog.csdn.net/m0_54342116/article/details/152740281
https://synscan.net/vuln/flowise-has-an-arbitrary-file-read