maradonam18/-cve-2025-59528-pocA simple python script to exploit CVE-2025-59528, this an Authenticated RCE vulnerability in Flowise application, a popular AI tool. That is also used in HTB seasonal challenge. The issue is present in version <= 3.0.5, for more details: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p
FOR EDUCATIONAL PURPOSES ONLY A simple python script to exploit CVE-2025-59528, this an Authenticated RCE vulnerability in Flowise application, a popular AI tool, that is also part of an HTB seasonal challenge, on which I tested it btw. If it's not working, make sure the command you are running is correct (hint: busybox).
The issue is present in version <= 3.0.5, for more details: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p
clone the repo
git clone --depth 1 https://github.com/maradonam18/-CVE-2025-59528-PoC.git
create a virtual env and install the dependencies
python3 -m venv .venv
# activate it
source .venv/bin/activate
# install requests
pip3 install -r requirements.txt
# alternatively, on debian based some python packages can be installed from the main repos
sudo apt install python3-requests
Make the file executable and run it
chmod +x CVE-2025-59528.py
./CVE-2025-59528.py -t http://your.domain.com/ -cmd <CMD> -k your_api_key