CVE-2026-56273
Flowise - Path Traversal in Vector Store basePath Parameter
CVSS Score
6.5
EPSS Score
0.3%
EPSS Percentile
25th
Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated users. Attackers with valid API tokens can write vector store data to arbitrary filesystem locations, potentially enabling code execution or data exfiltration.
| CWE | CWE-22 |
| Vendor | flowise |
| Product | flowise |
| Published | Jul 8, 2026 |
| Last Updated | Jul 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for flowise flowise
Be the first to know when new medium vulnerabilities affecting flowise flowise are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
Flowise / Flowise
0 < 3.1.0
Flowise / Flowise
0 < 3.1.0
References
Credits
🔍 tenbbughunters