Description
Flowise是FlowiseAI推出的开源AI工作流可视化编排平台，通过拖拽方式构建大语言模型应用，支持自定义节点、文档加载、向量检索等功能，广泛应用于智能问答、知识库、自动化流程等场景。Flowise /api/v1/chatflows 接口存在路径遍历漏洞，攻击者可在未进行身份验证的情况下向服务器任意可写路径写入文件，进而可能导致远程代码执行并完全控制目标系统。
Flowise /api/v1/chatflows 文件上传漏洞（CVE-2025-71334）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-71334
https://www.cve.org/CVERecord?id=CVE-2025-71334
https://github.com/advisories/GHSA-w5r9-j49j-2m55
https://www.vulncheck.com/advisories/flowise-arbitrary-file-access-via-missing-chat-flow-id-validation
https://vuldb.com/zh/cve/CVE-2025-71334
https://cve.imfht.com/detail/CVE-2025-71334
https://avd.aquasec.com/nvd/2025/cve-2025-71334/
https://corgea.com/advisories/vulnerabilities/CVE-2025-71334
https://db.gcve.eu/vuln/cve-2025-71334
https://app.opencve.io/cve/?page=2&product=flowise&vendor=flowiseai
https://feedly.com/cve/vendors/flowiseai