CVE-2025-61913
Critical · 9.9Flowise is vulnerable to arbitrary file write through its WriteFileTool
CVSS
9.9
EPSS
13.0%
Published
Oct 9, 2025
CISA due date
—
The record
The WriteFileTool in Flowise does not restrict the file path for reading, allowing authenticated attackers to exploit this vulnerability to write arbitrary files to any path in the file system, potentially leading to remote command execution.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | Flowise | 0 | 3.0.8 |
| npm | flowise | 0 | 3.0.8 |
| npm | flowise-components | 0 | 3.0.8 |
Related vulnerabilities
- CVE-2026-46478 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46477 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46479 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46480 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46442 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46444 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46440 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise
- CVE-2026-46475 Flowise is a drag & drop user interface to build a customized large language model flow. Also affects flowise