CVE-2025-61913 is a critical (CVSS 9.9) path traversal in Flowise, the drag and drop builder for LLM flows. Before version 3.0.8, WriteFileTool and ReadFileTool do not restrict file paths, so an authenticated user can read and write files anywhere on the server. The fix is Flowise 3.0.8.
What's affected
- Product: Flowise, a drag and drop interface for building customized large language model flows (npm package
flowise). - Weakness: CWE-22, path traversal.
- Affected: versions before 3.0.8. The linked read-file advisory lists versions up to 3.0.5.
- Fixed: 3.0.8.
- Components: WriteFileTool and ReadFileTool.
- CVSS 3.1: 9.9, vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. A low-privilege account is required and the scope is changed.
Two advisories are tied to this CVE: one for the read tool and one for the write tool. The read advisory explains that the tool takes a path from the model's input and passes it to the file store without checking that it stays inside Flowise's working directory.
How to check if you're exposed
Check the version you run:
npm ls flowise
npm ls -g flowise
docker image ls | grep -i flowise
For containers, check the image tag and, if you use latest, check when it was last pulled.
Anything below 3.0.8 is affected. Then ask a second question: do any of your flows use the read file or write file tools? The risk comes from giving an agent or a user those tools. List your flows and look for those nodes. Also check who can log in to Flowise and build or run flows, because the vector needs an authenticated account.
If the Flowise port is open to the internet with open sign-up, treat the instance as exposed.
What to do now
- Upgrade Flowise to 3.0.8 or later and redeploy.
- Until you upgrade, remove ReadFileTool and WriteFileTool from flows, or restrict which users can build and run flows.
- Review accounts on the instance and remove any that are not needed.
- Treat secrets stored on the Flowise host as at risk if untrusted users had access. This includes the encryption key and database the advisory discusses, API keys and cloud credentials.
- Run Flowise as a non-root user in a container with a read-only root filesystem where possible, and limit the volumes it can see.
- Use the free in-browser dependency scan on projects that embed Flowise to confirm the fixed version.
Why it matters
Path traversal (CWE-22) happens when a program builds a file path from input and never confirms the final path stays in the intended folder. Here the file tools handed the model's path straight to the filesystem. Giving a large language model a file tool is like giving a user a file browser, so the tool has to enforce limits on its own.
The advisory points out that reading sensitive files, such as keys and databases, can lead to taking over the instance, and that writing files can lead to remote command execution. That is why the score is 9.9.
This ties to a wider pattern in agent platforms: tools that act on the host need an allow list of folders, and agents should run with the least access they need. Reachability analysis helps here, because it tells you whether your own flows actually call the risky tools. The record does not flag exploitation in the wild, and this is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need an account to exploit this?
Yes. The record describes authenticated attackers, and the vector requires low privileges. Open sign-up still makes that bar easy to clear.
What is the fixed version?
Flowise 3.0.8, per the record and the release linked from it.
Sources
- github.com/FlowiseAI/Flowise/security/advisories/GHSA-j44m-5 (fetched)
- Safeguard Gold entry for CVE-2025-61913
- github.com/FlowiseAI/Flowise/commit/1fb12cd93143592a18995f63 (listed in the CVE record, not fetched)
- github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.8 (listed in the CVE record, not fetched)
Last reviewed: 18 October 2026.
