GHSA-q67q-549q-p849: Flowise has arbitrary file access due to missing chat flow id validation

September 15, 2025

Missing chat flow id validation allows an attacker to access arbitrary file.

References

github.com/FlowiseAI/Flowise
github.com/FlowiseAI/Flowise/commit/8bd3de41533de78e4ef6c980e5704a1f9cb7ae6f
github.com/FlowiseAI/Flowise/commit/c2b830f279e454e8b758da441016b2234f220ac7
github.com/FlowiseAI/Flowise/security/advisories/GHSA-q67q-549q-p849
github.com/advisories/GHSA-q67q-549q-p849

Code Behaviors & Features

Detect and mitigate GHSA-q67q-549q-p849 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →