majpuv/flowise-arbitrary-file-read-getfilefromstorageUnauthenticated arbitrary file read in Flowise (< 2.2.4) via path traversal in getFileFromStorage (storageUtils.ts). Caused by un-sanitized file path combined with mass-assignment in PUT /api/v1/document-store/store/:id. Allows full compromise via /root/.flowise/encryption.key read. Distinct from CVE-2025-71338 (fixed in 2.2.4).
getFileFromStorage) — proposed NEW CVEA separate vulnerability from CVE-2025-71338 (which is the write sink). This is an
unauthenticated arbitrary file read in the Flowise document-store loader "rehydrate" path,
affected 1.7.1 – 2.2.3, fixed in 2.2.4. Reading /root/.flowise/encryption.key yields
the key that decrypts all stored provider credentials → full credential compromise.
| File | Purpose |
|---|---|
report.md | The new-CVE submission: root cause, vuln path, CVSS, impact, affected versions, solution, PoC, distinction from existing CVEs |
poc.py | Self-proving PoC (stdlib only) — forges loaders via mass assignment, triggers the FILE-STORAGE:: rehydrate read, prints the file contents in-band |
docker/Dockerfile | Version-parameterized lab image (FROM the real vendor image; zero overlay) |
setup.sh | Builds/starts the lab (FLOWISE_VERSION, default 2.1.0); classifies affected vs fixed |
evidence.txt | Live verification: byte-exact encryption.key exfil on 2.1.0 & 2.2.3; NOT-EXPLOITABLE on 2.2.4 |
# start an affected lab (default 2.1.0):
bash setup.sh
# exfiltrate the credential-decryption key (self-proving; no listener):
python3 poc.py http://127.0.0.1:3510 --read-path /root/.flowise/encryption.key
# ground truth:
docker exec <container> cat /root/.flowise/encryption.key
getFileFromStorage(file, ...paths) does path.join(getStoragePath(), ...paths, file) +
fs.readFileSync with file unsanitized (raw ≤ 2.2.3, _sanitizeFilename added in 2.2.4);
file is attacker-supplied via the FILE-STORAGE:: loader value, and the gating loaders[].files[]
entry is forged by the PUT /store/:id mass assignment (Object.assign(entity, req.body)).